Security

Authentication and scopes

Use hashed Bearer API keys for direct integrations, or ChatterBeam OAuth for user-facing MCP clients.

API keys

New dashboard-created keys begin with cb_sk_. Existing echo_sk_ keys remain valid. ChatterBeam stores a SHA-256 hash, display prefix, scopes, expiry, and usage metadata—never the recoverable plaintext key.

Authorization: Bearer cb_sk_...

Keys can expire automatically, be revoked immediately, and be restricted to read-only or custom scopes.

Account kill switch

Turning off API access in Account settings immediately blocks API keys, OAuth access tokens, and refresh-token exchange. Dashboard sign-in remains available so an owner can restore access.

OAuth for MCP

The MCP resource publishes protected-resource and authorization-server metadata. Modern public clients use an HTTPS Client ID Metadata Document (CIMD); older clients can fall back to dynamic registration. Both flows use Authorization Code with PKCE S256 and receive audience-bound, scoped access tokens plus rotating refresh tokens after the user approves access.

Discovery

GET /.well-known/oauth-protected-resource
GET /.well-known/oauth-protected-resource/mcp
GET /.well-known/oauth-authorization-server

Secrets stay protected

OAuth access and refresh tokens are opaque. Only hashes, scopes, audience, expiry, and revocation state are stored; the plaintext token is returned only when issued.

Scopes

projects:readProjects and team membership

projects:writeProjects and team membership

keywords:readTracked keywords and keyword groups

keywords:writeTracked keywords and keyword groups

mentions:readMentions, statuses, analytics, categories, and saved views

mentions:writeMentions, statuses, analytics, categories, and saved views

alerts:readInstant alerts and daily digests

alerts:writeInstant alerts and daily digests

integrations:readProvider and LinkedIn connections

integrations:writeProvider and LinkedIn connections

account:readAccount settings and workspace access

account:writeAccount settings and workspace access

usage:readPlan usage and limits

webhooks:readWebhook endpoints and deliveries

webhooks:writeWebhook endpoints and deliveries

Project authorization

Authentication identifies an actor; it does not grant blanket access to every project. Each lookup checks current membership and minimum role. Writes require editor or owner access, while account, membership, provider, and archival operations require the owner.

Resource hiding

Resources in inaccessible projects respond as not found, preventing tenant IDs and existence from leaking.