API authentication
Wirechunk’s management API accepts authenticated browser sessions and OAuth access tokens. All operations resolve to a user and then check the permission required for the account, site, or resource involved.
OAuth clients
Use the management MCP resource at https://app.wirechunk.com/mcp. Discover its authorization configuration through the protected-resource metadata at https://app.wirechunk.com/.well-known/oauth-protected-resource and the authorization-server metadata it identifies.
Request the wirechunk:manage scope as part of the supported OAuth flow. The user signs in, reviews the client, and approves access. The same authorized token can authenticate management HTTP requests with the appropriate audience and scope.
curl 'https://app.wirechunk.com/api/sites' -H "Authorization: Bearer $WIRECHUNK_ACCESS_TOKEN"
Use the OAuth client’s token and renewal handling. The management API does not provide a separate personal API-key creation workflow. A disconnected client must be authorized again; obtaining another token does not bypass revoked consent.
Browser sessions
The Wirechunk application uses its signed-in session cookie for management requests. Session cookies are protected from JavaScript access and use secure settings on HTTPS. Browser mutation requests are also checked against the permitted application origin.
Do not copy a browser’s session cookie into a shared script or a published page. Use an authorized OAuth client for external integrations.
Permissions and verification
The user’s email must be verified for management operations, apart from the identity check used to establish account state. An invited collaborator must accept the appropriate invitation before working on a site.
A content collaborator can work on sites shared with them. Billing access alone does not reveal site content. Owner-only operations retain their owner requirement even when invoked by an agent or HTTP client.
Diagnose authentication failures
A 401 means the request lacks a usable authenticated identity, or that a connected agent’s authorization is no longer valid. A 403 can indicate missing verification, insufficient permission, or an invalid browser origin. Read the error’s code, detail, and resolution before deciding whether to reconnect or request access.