DevelopersGet started

Authentication

Create an AutoRFP.ai API key, choose its Default User and scopes, send it as a Bearer token, and keep it safe. Includes the OAuth sign-in used by MCP clients.

The REST API authenticates with an API key sent as a Bearer token. The same key also works as the bearer token for the MCP server.

Authorization: Bearer autorfp_api_...

API keys start with autorfp_api_.

Create an API key

You create keys in the AutoRFP.ai app. You need permission to create API keys in Developer settings. If you don’t see Create API Key, ask your workspace admin.

Open Settings, then Developer, then API Keys.
Select Create API Key.
Give the key a name that says what it is for, such as the integration that will use it.
Pick a Default User. The key acts as this user.
Select the scopes the key needs.
Create the key and copy it when it is shown.

Copy the key when it is shown and store it in a secret manager.

Default User

A key acts as its Default User, so it can only reach what that user can reach in the app. Pick the user whose access matches the job: a key for a reporting script should not act as an administrator.

A key stops working if its Default User is deactivated or removed. Choose a user who will stay in the workspace, and create a new key if the user leaves.

Scopes

Scopes limit what a key can do. Select only the scopes your integration needs: a :read scope cannot change anything. Each endpoint in the reference lists the scope it requires, and a request without it fails with 403.

Scope	What it allows	Applies to
ProjectsFull access to your RFP projects, requirements, and responses.
`projects:read`	Read projectsView your RFP projects, requirements, and responses.	REST APIMCP
`projects:write`Write	Write projectsUpdate custom project field values on your RFP projects.	REST API
RequirementsFull access to the answers to requirements on your RFP projects.
`requirements:write`Write	Write requirement answersReplace the answers to requirements on your RFP projects.	MCP
OrganisationFull access to your organisation's settings.
`organisation:read`	Read organisationView organisation settings such as custom project field definitions.	REST API
Content libraryFull access to the approved content and answer library.
`content:read`	Read content librarySearch the approved content and answer library.	REST APIMCP
`content:write`Write	Write content libraryApply, remove, or replace tags on content library items.	REST API
`content:edit`Write	Edit content libraryReplace the answer or section text of content library items.	MCP
TagsFull access to your organisation's tags and tag categories.
`tags:read`	Read tagsView the tags and tag categories used to organise your projects and content.	REST APIMCP
TeamsFull access to your organisation's teams.
`teams:read`	Read teamsView the teams configured for your organisation.	REST API

Write scopes are enabled per organisation. Contact your AutoRFP.ai account team to turn them on.

Send the key

Send the key in the Authorization header on every request:

Authenticated request

curl https://api.autorfp.ai/v1/organisation \
-H "Authorization: Bearer $AUTORFP_API_KEY"

const response = await fetch("https://api.autorfp.ai/v1/organisation", {
headers: { Authorization: "Bearer " + process.env.AUTORFP_API_KEY },
});

import os
import requests

response = requests.get(
"https://api.autorfp.ai/v1/organisation",
headers={"Authorization": "Bearer " + os.environ["AUTORFP_API_KEY"]},
)

A request with a missing or invalid key returns 401. See Errors.

Keep your keys safe

Keep keys in a secret manager or an environment variable, never in source control, client-side code or a shared document.
Use one key per integration, so you can revoke one without breaking the others.
Give each key the fewest scopes and the least-privileged Default User that does the job.
Revoke a key you no longer use, or that may have been exposed. Users with permission to manage API keys can revoke them from the same API Keys screen.

OAuth for MCP clients

Interactive MCP clients such as Claude, ChatGPT and Cursor do not use a key. They sign the user in with OAuth 2.0 Authorization Code with PKCE and register themselves through dynamic client registration. The client then acts with that user’s permissions.

Access tokens last 1 hour. Refresh tokens last 30 days and rotate each time they are used. Clients that support MCP discover the sign-in endpoints themselves from the OAuth server metadata and the protected resource metadata.

See Connect an AI assistant for the setup steps.