Reference

Authentication

API keys, test and live, embed tokens, OAuth for the MCP server, and platform credentials.

API keys

Send your key as a bearer token:

bash

curl https://squiggli.billy-965.workers.dev/v1/me -H "Authorization: Bearer sq_live_..."

Keys belong to one business. Make and revoke them under Settings, API keys, or with POST /v1/api-keys and DELETE /v1/api-keys/{id}. A key is shown once and stored only as a hash. Revoking one stops it straight away, along with any MCP connections approved with it.

Prefix	Can
`sq_live_`	Everything, live and test envelopes. Manage keys.
`sq_test_`	Everything, but every envelope it makes is a test one. Cannot manage keys.

Keys are secrets. Keep them on your server, in environment variables. Never put one in browser code, a mobile app or a git repository.

Embed tokens

Short-lived tokens for showing squiggli inside your web app, minted by your server with POST /v1/embed-tokens. A token reaches only its scope: the template editor, or one envelope. See Embedding.

MCP and OAuth

The MCP server at https://squiggli.billy-965.workers.dev/mcp accepts an API key as a bearer token. Clients that can't take a key (the Claude app, ChatGPT) use OAuth 2.1 with PKCE and dynamic client registration: they find everything at /.well-known/oauth-authorization-server, and the person approves on squiggli's consent page by signing in.

Your account

GET /v1/me tells you which business a credential acts for, whether it can send live envelopes, how many free envelopes are left, and the prices.