Authentication
Live work requires your Contrie account. Over MCP, connect with no credential and sign in through your browser — there is no key to copy. For the REST API, CI and other headless use, create an API key. Both reach the same account, plan and credits. The exact recorded requests listed in /llms.txt need neither.
MCP: Sign In, No Key
Point your MCP client at https://www.contrie.com/mcp with no credential. In Claude Code:
claude mcp add --transport http contrie https://www.contrie.com/mcp
contrie shows “Needs authentication”. Run /mcp, pick contrie and choose Authenticate, or run claude mcp login contrie; you sign in and approve in the browser. Sign-in is verified with Claude Code and a claude.ai custom connector; other clients' OAuth flows, including Claude Desktop's, are not yet verified. See MCP for every client.
OAuth does not also require an API key. After approving access, call contrie_account to check the connection. If an existing conversation still asks for authentication, follow reconnect, token renewal and account switching. A browser login and an active tool connection are separate checks.
API Keys: REST and Headless
- Create an account at contrie.com/sign-up (the recorded examples on the home page need no account)
- Go to Dashboard → API Keys
- Click "Create API Key"
- Copy the key immediately — it is only shown once
Using Your API Key
Pass your key in the Authorization header as a Bearer token:
Authorization: Bearer ck_live_abc123def456...
Key Format
| Prefix | Environment | Length |
|---|---|---|
| ck_live_ | Contrie account access | 40 characters |
Contrie currently issues only ck_live_ keys. The prefix does not select a testing environment or Stripe billing mode. Use the exact recorded demo for a keyless evaluation; a custom keyed request is live work and can consume your allowance.
Key Management
You can create up to 20 keys, name them, and delete them from the API Keys page in your dashboard. Keys are hashed on our servers — we never store your key in plain text.
Using Your Key with MCP
For MCP clients without a browser, the hosted server at https://www.contrie.com/mcp takes the same key as an Authorization header on the connection. See MCP for install snippets.
OAuth connection requirements
The OAuth boundary accepts only Clerk-issued JSON Web Tokens (JWTs) for the configured issuer and the audience https://www.contrie.com/mcp, with the explicit contrie:account permission. That permission grants extraction, verification and monitor access on the same terms as an account API key. Profile and email scopes alone do not grant account access. Clerk profile email is fetched only when separately granted.
Opaque OAuth tokens are unsupported. Verified end to end with Claude Code on 2026-09-21 and with a claude.ai custom connector on 2026-09-24. The provider must configure the custom permission and resource audience, which the hosted instance now does. An independent client (Claude Code) discovered the challenge, identified itself, completed the browser flow and called an authorized tool with the resulting token. An API key remains the path for headless clients and REST. JWTs are checked for signature and expiry; immediate revocation of an issued JWT is not guaranteed.
Security Tips
- Never expose your API key in client-side code
- Store keys in environment variables
- Rotate keys periodically
- Delete keys you no longer use