Authentication

Every request carries a bearer token in the Authorization header. An API key belongs to one workspace: an owner or admin creates it under Connections inside that workspace, it starts with pc_, it is shown once, and it acts with admin-level access to that workspace and nothing else. Keep it out of client-side code; revoking it takes effect immediately, and so does the creator losing their admin role.

An OAuth access token from the MCP connector flow works in the same header. It is bound to the workspace the person chose when they connected, with that person's own access. Either way, a credential opens exactly one workspace, and everything below is scoped to it.

curl https://usepaperclerk.com/api/v1/templates \
  -H "Authorization: Bearer pc_YOUR_TOKEN"