Spaitial Authentication

generated: '2026-07-21'
method: searched
source: >-
  https://docs.spaitial.ai/api/authentication, https://docs.spaitial.ai/api/llm-skills,
  and the securitySchemes in openapi/spaitial-developer-api-openapi.json.
description: >-
  The SpAItial Developer API authenticates with a bearer API key issued from the
  developer portal (developers.spaitial.ai). Keys are scoped and enforced
  server-side; the hosted MCP server accepts the same keys (BYOK) as either a
  Bearer token or an X-Spaitial-Api-Key header, and additionally advertises
  OAuth 2.0 in its MCP server card.
summary:
  types:
    - http
schemes:
  - name: api-key
    type: http
    scheme: bearer
    bearerFormat: API Key
    in: header
    header: Authorization
    description: >-
      Bearer API key issued by the developers site. Production keys look like
      spt_live_<32-char-base32>; test keys use the spt_test_ prefix (same scopes,
      lower rate limits). Keys are shown once at creation. A missing, unparseable,
      or revoked key returns 401 UNAUTHORIZED.
    sources:
      - openapi/spaitial-developer-api-openapi.json
key_format:
  production_prefix: spt_live_
  test_prefix: spt_test_
  example: spt_live_abc123def456...
scopes:
  enforcement: Server-side; a call outside the granted scopes returns 403 FORBIDDEN.
  values:
    - {scope: 'worlds:create', grants: 'POST /v1/worlds, POST /v1/panoramas/edit'}
    - {scope: 'worlds:read', grants: 'GET world requests/status/result/exports/splat/panorama, GET panoramas, GET models'}
    - {scope: 'worlds:write', grants: 'PATCH world, cancel job, start export'}
    - {scope: 'files:create', grants: 'POST /v1/files'}
    - {scope: 'files:read', grants: 'GET /v1/files'}
  detail: scopes/spaitial-scopes.yml
mcp_auth:
  server: https://mcp.spaitial.ai/mcp
  byok: true
  schemes: [bearer, oauth2]
  headers: ['X-Spaitial-Api-Key: spt_live_...', 'Authorization: Bearer spt_live_...']
revocation:
  mechanism: Revoke a key from the developer portal; takes effect on the next request.
  note: Creating a new key does not invalidate existing ones — revoke the old key explicitly.
docs: https://docs.spaitial.ai/api/authentication