Authentication
How Cloud identifies callers through sessions, API keys and app user tokens.
Cloud verifies a credential to identify the caller of a request. Sessions identify people signed in to CrabTalk, API keys identify their creator acting on an account, and app user tokens identify users of another website.
| Credential | Identity |
|---|---|
| Session | A person signed in to CrabTalk |
API key (ck_…) |
Its creator acting on the account the key belongs to |
| App user ID token | A user identified by an issuer trusted by the registered app |
Permissions determine which operations the identified caller can perform.
Sessions
A session is obtained through sign-in on the website or normal browser-based crab login. Revoked or expired sessions are rejected. A session expires after seven days unused; its server-side session record determines whether it is active.
API keys
An API key starts with ck_. Cloud matches its hash to an active key record and rejects revoked or expired keys. Create and manage keys through API keys. MCP connectors and crab login --device obtain dedicated API keys when a person approves the connection name, permissions and daily budget. The credentials appear under Settings → API keys.
App users
An app request names its registration in X-App. A signed-in user supplies an ID token from one of that app's configured identity providers. Cloud verifies the token's signature, issuer and client ID. The service sees the user as an issuer and subject, while the calling account is the app's owner.
An app registered for anonymous access may omit the user token; such a request has no authenticated end user. The app's origin, destination and tool-access rules are described in Permissions.
Sending a token
The website and crab send their stored credentials automatically. MCP clients use the credentials configured or obtained during their connection setup.
For a direct HTTP request, send the session token or API key as a bearer token:
Authorization: Bearer <token>An app request uses the same header for its user ID token, alongside X-App.
Webhook signatures
Webhook senders sign deliveries with the destination service's signing secret. Cloud verifies the signature and timestamp before forwarding the delivery. See Webhooks for the signing scheme and required headers.
Invalid credentials
When a route requires a credential, a missing, invalid, revoked or expired one receives 401.
On service and catalog routes that accept optional authentication, an invalid token receives 401 rather than silently falling back to anonymous access.