# Authentication

> Sign in with OAuth from your client, or send an API key. Both spend one workspace's credits.

Manifold takes two kinds of credential. Both go to `https://mcp.manifoldmcp.com/mcp` as a bearer token, and both spend the credits of one workspace.

|  | OAuth | API key |
| --- | --- | --- |
| For | Chat apps and coding agents that can sign in | Scripts, CI, and clients that cannot run OAuth |
| How | Your client opens a browser and you sign in | Copy a key from the app and send it as a header |
| Spends | Your personal workspace's credits | The credits of the workspace that made the key |

## OAuth

Most clients find the sign-in by themselves. The server publishes its OAuth metadata (RFC 9728) and the client runs OAuth 2.1 with PKCE:

```text
https://mcp.manifoldmcp.com/.well-known/oauth-protected-resource/mcp
```

You see the Manifold sign-in page. Sign in with Google or email and approve the client. The first sign-in creates your account with 500 free credits.

## API keys

The dashboard at [app.manifoldmcp.com](https://app.manifoldmcp.com) has a key ready to copy. Make more keys, and revoke them, on the API keys page. Send a key in the `Authorization` header:

```http
Authorization: Bearer mk_live_...
```

A key you make on the API keys page is shown once. Manifold keeps only a hash of it, so a lost key cannot be recovered: revoke it and make another. A revoked key can keep working for up to a minute while the change reaches every data centre.

## Workspaces

Credits, keys, usage and billing belong to a workspace, not to a person, so a team shares one balance and one set of keys. Sign-up creates a personal workspace, and the account menu in the app switches between workspaces.

> OAuth spends your personal workspace's credits. To spend a team workspace's credits from a client, use an API key made in that workspace.

## Turn tool groups off

The app's Tools page has a switch for each tool group. A group that is off is not in the tool list your clients see, and the change reaches the server within a minute. [`get_task`](https://www.manifoldmcp.com/docs/tools#async-tasks) has no group and is always there, so a task that already started can still be read.

## When a request is refused

A missing or bad credential gets HTTP 401 with a `WWW-Authenticate` header that points at the OAuth metadata. The `error_description` says why:

| Description | What to do |
| --- | --- |
| Bearer token required | Send a token, or sign in from your client |
| API key is unknown or revoked | Copy a current key from the app |
| OAuth token is invalid or expired | Sign in again from your client |