Skip to main content
Every endpoint under https://api.gabin.ai/v1 requires an Authorization: Bearer <token> header, except GET /v1/health and GET /v1/openapi.json. The token is either an API key or an OAuth access token. Both are tied to your account: same limits, same quota, same usage page.

​
API keys

Use an API key from your own code, scripts and servers, and from MCP clients that accept a header (Claude Code, Cursor, VS Code).
  • Create a key at gabin.ai/compte/api. Your account needs a verified email: an account created with GitHub or Google has one; an email-and-password account gets a verification link.
  • Format: gab_live_ followed by 43 characters. The key is shown once; Gabin stores only a hash of it, so a lost key cannot be recovered. Create a new one.
  • Up to 5 active keys per account. Name them by use (prod, staging, laptop) so you can revoke one without breaking the others.
  • Revoke a key from the same page. It stops working within a minute.
A key gives access to your account and its quota. Keep it server-side: in an environment variable or a secret manager, never in front-end code, a public repository or a mobile app. To use Gabin from a browser (for example map tiles), call it through your own backend.

​
OAuth 2.1 (MCP connectors)

Assistants such as Claude and ChatGPT connect to the MCP server with OAuth: you add the server URL, sign in to Gabin, and approve the access on a consent screen. You never paste a key. The consent screen shows the domain that will receive the access. Approve only an application you have just connected yourself. You can see and revoke authorized applications at gabin.ai/compte/api, under Applications autorisées; revoking cuts the access immediately. An OAuth access token also works on the REST API, with the same limits as your keys.

​
When authentication fails

On the MCP server, a missing or refused token returns 401 with a WWW-Authenticate header that points to the protected resource metadata, which is how MCP clients start the OAuth flow. See errors for the full list.