← API reference

API keys

Authenticated agents call the keyed REST and MCP surfaces with a workspace API key. Public booking (OTP) does not need a key.

Format

Send the key as an HTTP Bearer token:

Authorization: Bearer tofu_live_<32-char-secret>
# or
Authorization: Bearer tofu_test_<32-char-secret>

Where to mint keys

Sign in to your workspace, then open Settings → API keys. Create a key, copy it once, and store it in your agent’s secret store. Revoke unused keys from the same page.

Which transport

  • Keyed host MCP: /api/mcp/mcp
  • Public booker MCP (no auth): /api/mcp/public/mcp
  • REST: /api/v1 — see the OpenAPI reference

Building an agent from scratch? Start at agent onboarding or agent discovery.