> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mentionpath.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate REST API requests with bearer tokens or OAuth access tokens issued by Mentionpath.

All REST API requests use bearer authentication. Create tokens in the Mentionpath app under **Account → API**, or connect an MCP client and complete the OAuth flow — both issue tokens scoped to your organization.

## Base URL

```
https://api.mentionpath.ai/api/v1
```

## API tokens

1. Open **Account → API** in the app.
2. Choose the scopes your integration needs (read-only scopes are preselected).
3. Create a token and copy the secret — it is shown once.

Send the token on every request:

```bash theme={null}
curl -sS \
  -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.mentionpath.ai/api/v1/domains
```

## OAuth (MCP clients)

Hosted MCP clients (Claude, ChatGPT, Cursor, and others) use OAuth instead of manual tokens. Discovery metadata is published at:

* `https://api.mentionpath.ai/.well-known/oauth-authorization-server`
* `https://api.mentionpath.ai/.well-known/oauth-protected-resource`

The MCP endpoint is `https://api.mentionpath.ai/mcp` (Streamable HTTP, POST only). See the [MCP tab](/mcp/overview) for client setup.

## Idempotency

Include an `Idempotency-Key` header on write requests (`POST`, `PATCH`, `DELETE`) to safely retry without duplicating work:

```bash theme={null}
curl -sS -X POST \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Idempotency-Key: create-prompt-001" \
  -H "Content-Type: application/json" \
  -d '{"title":"Best CRM for startups"}' \
  https://api.mentionpath.ai/api/v1/domains/DOMAIN_ID/prompts
```

## Errors

| HTTP status | Meaning                                                                 |
| ----------- | ----------------------------------------------------------------------- |
| `401`       | Missing or invalid token                                                |
| `403`       | Token lacks the required scope or domain access                         |
| `404`       | Resource not found                                                      |
| `202`       | Write accepted but requires [human approval](/api/scopes-and-approvals) |
| `429`       | Rate limited                                                            |