Skip to main content
MoltSets uses API key authentication. Every request must include your API key as a Bearer token in the Authorization header.
API keys follow the format ms_XXXXXXXXXXX.

​
Creating an API key

API keys are managed at app.moltsets.com.
  1. To create an API Key, choose “create an API key”
  2. Give it a name then click “create now”
Store your API key somewhere secure as soon as you create it!

​
Using your API key

Pass the key as a Bearer token on every request:

​
User-Agent header

Every request — REST or MCP — must also send a User-Agent header. MoltSets doesn’t check its contents, only that it’s present; any non-empty value is accepted. Requests missing it are rejected with 403 Forbidden (error.code: forbidden) before authentication is even checked. Most HTTP clients and MCP clients set a User-Agent by default, so this usually needs no extra work. If you’ve built a custom client that sends bare requests (or an MCP client that lets you omit the header), set one explicitly — see Other MCP clients for the MCP case.

​
Multiple keys

You can create as many API keys as you need. The recommended pattern is one key per environment or agent — for example, separate keys for local development, staging, and production. This makes it easy to revoke access for a specific environment without affecting others.

​
Revoking a key

You can revoke credentials individually or all at once:
  1. To revoke a single API Key or Connector, click Revoke to the right of the credential you want to remove.
  2. To revoke all credentials at once, use the Revoke All option on the page.
Revocation is immediate and irreversible.

​
OAuth — connecting an MCP client

MCP clients authenticate with an OAuth access token instead of a raw API key. Both credential types reach the same account and the same tools; use an API key for direct REST calls, and OAuth for anything connecting over the MCP server. Create the Client ID and Client Secret under Connectors at app.moltsets.com. Clients that support dynamic registration can register themselves instead. Metadata is discoverable at https://mcp.moltsets.com/.well-known/oauth-protected-resource and https://app.moltsets.com/.well-known/oauth-authorization-server.

​
Redirect URIs

https is accepted on any host. Plain http is accepted only on a loopback host — 127.0.0.1, [::1], or localhost — which is what lets a CLI or desktop client complete the flow on an ephemeral local port, the native-app pattern from RFC 8252 §7.3. Every other host requires https. For a registered loopback URI the port may vary between runs; scheme, host, path, and query must still match exactly. Non-loopback URIs are matched exactly, port included. PKCE is mandatory for loopback redirects and is enforced at /oauth/authorize, before an authorization code exists. It remains optional for https redirect URIs. A granted token is used the same way as an API key:
MCP connections need a User-Agent header too — see above. Claude, Claude Desktop, and Claude Code set one automatically; other MCP clients may need to set one explicitly.

​
Key permissions

All API keys have the same permissions — there are no read-only or scoped keys. Any key can call any tool on your account.

​
Error responses

Every MoltSets error uses this shape — an error object with a code and a message. Branch on code; the message is for humans. The full list is in Errors.