Authentication

Two ways in: an API key for your code and coding tools, OAuth sign-in for AI apps.

API keys#

Send your key on every request, either way:

http
Authorization: Bearer mpd_live_…
# or
x-api-key: mpd_live_…
  • Create and revoke keys on the API keys page.
  • A key is shown once. We store only a hash of it, so a lost key cannot be recovered; make a new one.
  • Keys start with mpd_live_ and carry a checksum, so a mistyped key is refused instantly.
  • A revoked key stops working within a minute on every server.
Keep keys server-side
Anyone with a key can spend your request limit and read the same data you can. Don’t ship it in a browser or mobile app; call the API from your server.

OAuth (ChatGPT, Claude and other AI apps)#

AI apps cannot paste a key, so they sign you in instead. You add https://people-api.arihaan.ai/mcp as a connector, the app opens our sign-in page, you continue with Google and click Allow. The app receives a token that works like a key for your account.

  • OAuth 2.1 with PKCE, scope people:read. Clients register themselves (dynamic client registration).
  • Discovery: /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server.
  • Access tokens refresh automatically for 30 days.
  • See and disconnect connected apps on the API keys page.

The playground#

Signed in, the playground calls the same endpoints with your session cookie. Those calls count against your limit like any other.