Authentication

Your code uses an API key. AI apps sign users in with OAuth. Either way, the caller acts as one Sentinel user.

Every request carries a Sentinel credential that belongs to one user, and Sentinel checks that user's access on every call. A credential can never see more than its user can in the app.

#API keys

Create a key in Your account → Connected apps → For developers: API keys. Choose a name and an expiry (30 days, 90 days, a year, or never). Sentinel shows the full key once, when you create it.

Keys look like sk_live_ followed by 32 hex characters. Send the key in the Authorization header:

Authorization: Bearer sk_live_8f14e45fceea167a5a36dedd4bea2543

Authorization: ApiKey sk_live_… works too.

#What a key can do

• It acts as you. Calls run as the user who created the key, with the role the key got when it was created. If your role changes later, the key keeps its original role; revoke it and create a new one.
• It sees your matters only. See Access control.
• It's revocable. Revoke a key in Connected apps, and its next call fails with 401.

#OAuth sign-in

MCP clients that support OAuth need only your MCP address. They discover Sentinel's authorization server, register themselves, and send the user to a Sentinel sign-in page. The user signs in with their Sentinel email and password, plus an authenticator code if they use two-factor authentication.

The connection then appears under Your account → Connected apps, named after the app (for example Claude). Behind the scenes it's an API key, and disconnecting the app revokes it.

For endpoints and the full exchange, see OAuth for MCP clients.

#Who can connect

Firm staff accounts can create keys and connect apps: admins, attorneys, users, compliance officers, deal-team members and similar roles. Client accounts and other external people can't, and their keys get 403 from the REST API.

#Managing keys and connections