Authentication
Use a personal key with REST and MCP, or use OAuth for short-lived API and MCP access through https://auth.pinglymcp.com.
Personal API keys
One personal credential works with both the REST API and the MCP server.
- Sign in to PinglyMCP through
https://auth.pinglymcp.com. - Open Dashboard → API Keys.
- Name the key for the client or integration using it.
- Copy the key when it is displayed. PinglyMCP stores only its SHA-256 hash.
Authorization: Bearer pmcp_...The same header is used for REST requests and authenticated MCP requests.
Key permissions
In Dashboard → API Keys, choose Billing access as None, Read or Manage. This setting applies to billing endpoints in REST and billing tools in MCP; new keys have no billing access by default. Manage includes Read.
MCP tool permissions are a separate control. All tools grants current and future MCP tools and hides the tool list. Selected tools displays the complete non-billing tool list so you can choose which tools the key can list and run. Changing Billing access synchronizes the matching billing tools for a selected allowlist. An existing custom allowlist stays as saved until you change Billing access or the tool selection. MCP tool permissions do not restrict the key’s REST access.
OAuth for API and MCP
Registered clients and agents obtain short-lived OAuth access tokens from https://auth.pinglymcp.com/api/auth. Tokens are resource-bound, so request the resource and scope for the service you are calling.
REST API
resource: https://api.pinglymcp.com
scope: api:access
MCP
resource: https://mcp.pinglymcp.com
scope: mcp:accessOAuth clients use Authorization Code + PKCE. Users authenticate through the central email login, enter the one-time code sent to their email, and review the requested scopes before the client receives its authorization code on the registered callback. MCP clients that support Dynamic Client Registration can use the same authorization-code flow with their registered client.
Lifetime and revocation
Personal API keys do not expire automatically and remain active until revoked. OAuth access tokens are short-lived and can be renewed with a refresh token when the client requested offline access.