craaft Authentication

generated: '2026-11-04'
method: searched
source: https://craaft.io/docs
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - cookie
schemes:
- name: sessionAuth
  type: apiKey
  in: cookie
  parameter: craaft_session
  description: 'Browser session cookie (`__Host-craaft_session` in production,

    `craaft_session` in dev), set at sign-in. Not obtainable through

    this API - it''s here only so the handful of session-only routes

    below (the OAuth consent screen''s own endpoints, connected-apps

    management) can be marked accurately. They reject both bearer

    schemes with a 403.'
  sources:
  - openapi/craaft-io-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: cra_<24 base64url chars>
  description: 'Two token schemes, same permissions. `cra_<24 base64url chars>` is a

    personal access token minted in Settings, doesn''t expire on its own,

    and is revoked from the same page. `cro_<32 base64url chars>` is an

    OAuth access token issued to an OAuth client (an MCP client such as

    Claude) via the authorization-code-with-PKCE flow; it expires after

    1 hour and the client refreshes it. Either token authentic'
  sources:
  - openapi/craaft-io-openapi.yml
docs: https://craaft.io/docs
docs_notes:
- Base URL https://craaft.io/api/v1 . The version prefix is mandatory, and unversioned paths return 404.
- 'Header Authorization: Bearer cra_... on every request. The scheme is case-insensitive. Personal tokens start with cra_ ; tokens an MCP client gets from signing in start with cro_ .'
- Sign-in, API key management, billing and avatar upload stay session-only.
- Docs say tokens are "cra_ followed by 32 characters"; the spec bearerFormat says cra_<24 base64url chars> - the two disagree on length.
- OAuth 2.1 with PKCE for MCP clients; endpoints discovered at /.well-known/oauth-authorization-server (RFC 8414), per the spec bearerAuth description and https://craaft.io/mcp.