Security

Authentication and scopes

Use hashed Bearer API keys for direct integrations or OAuth 2.1 with PKCE for ChatGPT and other MCP clients.

API keys

Dashboard-created keys begin with stalkr_sk_. Stalkr stores a SHA-256 hash, a short display prefix, scopes, expiry, and usage metadata—never the recoverable plaintext key.

Authorization: Bearer stalkr_sk_...

Keys can be time-limited, revoked immediately, and restricted to read-only scopes.

OAuth for MCP

The MCP server supports OAuth authorization-code flow with PKCE S256, dynamic client registration, refresh-token rotation, resource indicators, token revocation, and protected-resource metadata.

Discovery

GET /.well-known/oauth-authorization-server
GET /.well-known/oauth-protected-resource/mcp

Refresh-token reuse protection

Refresh tokens rotate on every exchange. Reusing a rotated token revokes the entire connection family, which contains a stolen-token replay.

Scopes

projects:read/write

Projects and team membership

keywords:read/write

Tracked keyword configuration

mentions:read/write

Mentions, statuses, categories, and saved views

alerts:read/write

Alert rules

integrations:read/write

LinkedIn connection and sync

usage:read/write

Plan usage and limits

webhooks:read/write

Webhook endpoints and deliveries

account:read/write

Personal account settings

mcp:read/write

Access to the MCP resource server

Read and write scopes are separate. The mcp scope authorizes the protocol connection but never replaces the scope required by a tool.

Project authorization

Authentication identifies a user and workspace; it does not grant blanket access to every project. Each project resource is independently checked against owner, editor, or viewer membership. Writes require editor or owner access, and owner-only operations include project archival, team changes, and LinkedIn management.

Resource hiding

Resources in projects the user cannot access respond as not found. This avoids leaking IDs or existence across tenants.