Authentication

The MCP server does not accept abi_sk_ API keys. They are separate credentials for separate surfaces, and mixing them up is the most common integration mistake. Sending an API key as a Bearer token to the MCP server fails at the proxy.

Credential	Used for	How it travels
OAuth 2.1 Bearer token	The MCP server at `mcp.abigail.app`	`Authorization: Bearer <token>`, obtained by your assistant
API Key (`abi_sk_`)	The retired `/v1/openclaw/*` REST endpoints	`X-API-Key`
Clerk JWT	Developer portal (`/api/v1/developer/*`)	`Authorization: Bearer <token>`

OAuth for MCP (current)

This is the credential for every new integration. You do not create, copy, paste, or store anything: a compatible assistant discovers the authorization server, registers itself, and walks the user through sign in.

Purpose	Endpoint
Protected resource metadata	`https://mcp.abigail.app/.well-known/oauth-protected-resource`
Authorization server metadata	`https://api.abigail.app/.well-known/oauth-authorization-server`
Dynamic client registration	`https://api.abigail.app/oauth/register`
Authorize	`https://api.abigail.app/oauth/authorize`
Token and refresh	`https://api.abigail.app/oauth/token`
Identity	`https://api.abigail.app/oauth/userinfo`
Revoke	`https://api.abigail.app/oauth/revoke`

Grants are authorization_code and refresh_token, the code challenge method is S256, and the scope is full_access. Client authentication may be client_secret_post, client_secret_basic, or none for public clients. The full walkthrough, including the challenge your client receives on an unauthenticated call, is in Connect via MCP. To end an assistant’s access, revoke it from your Abigail account. The token stops working immediately.

API Key Authentication (legacy)

The /v1/openclaw/* endpoints this key authenticates were retired on 2026-07-18 and return 404. This section is kept for existing integrations and reference. Keys are still issued from Settings for internal use.

Paid legacy endpoints required an API key in the X-API-Key header.

Key format

abi_sk_{32_hex_characters}

Example: abi_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Using your key

curl -H "X-API-Key: abi_sk_your_key_here" \
  https://api.abigail.app/v1/openclaw/analyze

import httpx

resp = httpx.post(
    "https://api.abigail.app/v1/openclaw/analyze",
    headers={"X-API-Key": "abi_sk_your_key_here"},
    json={"application_number": "17200011", "office_action_text": "..."}
)

Key lifecycle

Create a key from Settings > API Keys
The raw key is shown once — copy it immediately
Only the SHA-256 hash is stored server-side
Revoke a key anytime from Settings > API Keys
Revoked keys are rejected immediately

Security best practices

Never commit API keys to source control. Use environment variables or a secrets manager.

Store keys in environment variables: ABIGAIL_API_KEY=abi_sk_...
Rotate keys periodically
Use separate keys for development and production
Revoke keys immediately if compromised

Error responses

Missing key

{
  "error": true,
  "error_code": "missing_api_key",
  "message": "Missing X-API-Key header.",
  "agent_suggestion": "This endpoint requires an Abigail API key. The user must create one at https://abigail.app and provide it to you."
}

Invalid key

{
  "error": true,
  "error_code": "invalid_api_key",
  "message": "API key invalid.",
  "agent_suggestion": "The API key is invalid. Ask the user to generate a new key at https://abigail.app"
}

Revoked key

{
  "error": true,
  "error_code": "revoked_api_key",
  "message": "API key revoked.",
  "agent_suggestion": "The API key is revoked. Ask the user to generate a new key at https://abigail.app"
}

Getting Started

MCP Connector

Concepts

OAuth for MCP (current)

API Key Authentication (legacy)

Key format

Using your key

Key lifecycle

Security best practices

Error responses

Missing key

Invalid key

Revoked key

​OAuth for MCP (current)

​API Key Authentication (legacy)

​Key format

​Using your key

​Key lifecycle

​Security best practices

​Error responses

​Missing key

​Invalid key

​Revoked key

OAuth for MCP (current)

API Key Authentication (legacy)

Key format

Using your key

Key lifecycle

Security best practices

Error responses

Missing key

Invalid key

Revoked key