Skip to main content
Decky AI’s MCP server supports two authentication methods. Use whichever fits your client.

OAuth — no API key

Sign in through a browser. Works with Claude.ai web and Claude Desktop.

API key

A bearer token for CLI clients and advanced setups.

​
OAuth (no API key) [#oauth]

Supported clients: Claude.ai web, Claude Desktop OAuth is the recommended method — you sign in once through a browser and Decky handles the rest. No API key to copy, store, or rotate.
1

Add the connector

Go to claude.ai/customize/connectors and click Add custom connector.
2

Enter the server URL

Click Save.
3

Authorize

Claude redirects you to Decky’s authorization page. Sign in with your Decky account (Google or Microsoft).
4

Done

Decky issues Claude a token — valid for the session and automatically refreshed. Claude can now call Decky tools on your behalf.
To disconnect: Go to app.decky-ai.com → Connections, find the app, and click Disconnect. This immediately revokes all tokens for that client.

​
API Key [#api-key]

Supported clients: Claude Code, Cursor, any HTTP MCP client API keys are long-lived credentials you include in every request as a bearer token. They suit CLI tools, automation, and any client that doesn’t support the OAuth browser flow.

​
Create an API key

1

Open the dashboard

Sign in at app.decky-ai.com and go to API Keys.
2

Create the key

Click Create key, enter a name (e.g. “Cursor — work laptop”), choose an expiry, and select the scopes you need.
3

Copy it immediately

The key starts with dk_live_ and is shown only once. Store it before closing the dialog.
Store it securely. Treat your API key like a password. If you lose it, you’ll need to create a new one. Decky never stores the plaintext key — only a hash.

​
Use an API key

Include it as a bearer token in every request:

​
Expiry & rotation

Keys can expire after 30 days, 90 days, 1 year, or never. When a key expires, requests return 401 Unauthorized. Create a new key and update your config before expiry. You can have up to 10 active API keys at once.

​
Revoke a key

Go to API Keys on the platform, find the key, and click Revoke. The key stops working immediately.

​
Scopes [#scopes]

Scopes limit what an API key (or OAuth grant) is allowed to do. When in doubt, select all scopes — you can restrict later.
The default when creating a key is all scopes. For least-privilege setups (e.g. read-only monitoring), select only what you need.

​
Security notes

  • Keys are stored as SHA-256 hashes. The plaintext is never retrievable.
  • OAuth tokens are short-lived and automatically refreshed.
  • All connections are HTTPS only. The server rejects plain HTTP.
  • IP filtering is not currently supported at the API-key level; use scopes to restrict capabilities.