OrgX uses different authentication mechanisms for each public integration
surface.
REST API Keys
REST Public Preview endpoints use user-scoped API keys. API keys begin with
oxk_ and inherit the workspace access of the user who created them.
API keys are secrets. Do not expose them in browser code, public repositories,
logs, screenshots, or client-side bundles.
Create an API Key
- Sign in to OrgX.
- Open Settings.
- Find OrgX API keys.
- Generate a key for the integration or sandbox workspace.
- Store the full key immediately. OrgX only shows it once.
The settings UI lists each key prefix, name, creation time, and last-used time.
Revoke keys from the same settings area when an integration is retired.
Workspace Scope
Every API key resolves to a user and workspace context. Route handlers enforce
that callers only read or write accessible resources. Do not pass arbitrary
user_id values in requests. API-key requests use the authenticated identity,
not a caller-provided identity.
Failed Authentication
Missing, revoked, malformed, or invalid keys return 401.
MCP OAuth
The hosted MCP server uses OAuth 2.1 with browser-based authorization and PKCE.
Remote MCP clients discover the auth server through protected-resource metadata
and manage token refresh automatically.
Use MCP OAuth for AI clients and MCP Apps. Use REST API keys for server-side
system integrations and local runtime bridges. 