Skroll API authentication

OAuth 2.1

The MCP server and CLI are OAuth resource servers. A client with no token receives 401 plus WWW-Authenticate pointing at /.well-known/oauth-protected-resource. From there it discovers the authorization server, registers as a public PKCE client, and completes the authorization-code flow. Access tokens act as the signed-in user in the organization they last used (or picked on the consent screen).

Discovery documents: https://skrollai.com/.well-known/oauth-protected-resource and https://skrollai.com/.well-known/oauth-authorization-server. See the MCP guide and the CLI guide.

Get a key

An owner or admin creates keys in Settings → Integrations. The key is shown once at creation; only its hash is stored, so copy it then. A key acts as its creator for writes. It can read anything the organization sees, but only modify skrolls that creator owns. Removing a member from the organization disables their keys immediately.

Send the key

Pass the key in the Authorization header:

curl https://skrollai.com/api/v1/decks \
  -H "Authorization: Bearer sk_..."

Rate limits

Limits are per credential, in fixed one-minute windows. Exceeding a bucket returns 429 with a Retry-After header.

Errors

Every non-2xx response uses one envelope. code is a stable machine string; featureId appears on 402 to name the metered feature that ran out of allowance.

{
  "error": {
    "code": "not_found",
    "message": "Skroll not found.",
    "featureId": "decks"
  }
}