Authentication & scopes
API keys, OAuth 2.1, scopes, and rate limits
Two ways to authenticate — both resolve to your organization.
API key
Programmatic and CLI access. Send it as x-api-key: sk_loom_… or Authorization: Bearer sk_loom_….
Keys are org-scoped, carry scopes, and are rate-limited. The plaintext is shown once at creation.
OAuth 2.1
For MCP connectors (Claude / ChatGPT). Clients discover and register automatically via
/.well-known/oauth-authorization-server, then sign you in with Google.
OAuth grants read scopes only. Write operations (e.g. creating a brand) require an API key
minted with the brands:write scope — an OAuth-connected agent can browse, but not mutate.
Scopes
| Scope | Grants |
|---|---|
brands:read | List/read brands and channels |
analytics:read | Summary and analytics |
mentions:read | Mention feed |
overview:read | Dashboard overview |
brands:write | Create brands / add channels (API key only) |
Rate limits & quota
Per-key, per-minute rate limit + monthly quota. When exceeded you get 429 with a Retry-After
header. Usage is recorded per request.