Skip to content
Navigation
View as Markdown

Authentication

Every surface — REST, SDK, CLI, and MCP — authenticates with the same API keys. Create and revoke them in the ThinkBench app under Settings → API keys. Keys are secrets: send them only in headers, never in URLs, and rotate any key that leaks.

API keys

Pass the key in the x-api-key header:

curl "https://app.thinkbench.com/api/v1/drives" \
  -H "x-api-key: $THINKBENCH_API_KEY"

A key acts as the user who created it: requests can reach exactly what that user can reach, nothing more. Requests without a valid key receive a 401 with a JSON error envelope.

Remote MCP clients can use OAuth 2.1 instead of a key — see MCP server.

Agent attribution

When software edits a document on your behalf, ThinkBench records who (the user behind the credential) and via what (the agent). Attribution changes who gets credited in version history — never what is authorized.

Two ways to declare an agent:

  • Create an agent key in Settings, which carries its agent name in the key itself.
  • Send an x-thinkbench-agent: <name> header (the SDK's agent config and the CLI's THINKBENCH_AGENT variable do this for you).

Remote MCP clients connected over OAuth are attributed automatically by their registered client name.