Authentication

The server accepts two kinds of bearer token on the same endpoint. People sign in with OAuth from their MCP client. Code that runs without a person, such as a reporting pipeline or an internal AI tool, sends a team API key. Both see the same tools, with the exceptions listed under what a key can do.

OAuth sign-in

MCP clients that implement the MCP authorization spec handle this flow themselves. You only give them the server URL. For reference, this is what happens.

1. Discovery

   A request without a valid token gets 401 with a WWW-Authenticate header. Its resource_metadata points to https://www.getchartkit.app/.well-known/oauth-protected-resource/mcp, which names the authorization server.

2. Registration

   The client registers itself at https://www.getchartkit.app/oauth/register (dynamic client registration), so there is no client id to set up.

3. Sign-in

   The client opens https://www.getchartkit.app/authorize, which sends the person to the ChartKit sign-in page. They sign in with Google, using the same account as the ChartKit extension. The scope is chartkit.

4. Token

   The client exchanges the code at https://www.getchartkit.app/oauth/token and sends the access token as Authorization: Bearer on every request.

Every tool call checks the person's plan. Without Pro, a trial, Team or Student, the call returns an error result that links to the dashboard, and nothing is drawn. Connecting and listing tools work on any plan.

Team API keys

A team API key lets your own code call the server without a person signing in. It belongs to a ChartKit Enterprise team, not to the employee who created it, so it keeps working when that person leaves the team.

Create a key

1. Open the team page

   Sign in at www.getchartkit.app/team as an owner or admin of a licensed ChartKit Enterprise team.

2. Name the key

   In the API keys panel, enter a name that says where the key runs, such as reporting-pipeline-prod, and create it.

3. Copy the secret

   The secret is shown once. Store it in your secret manager or deployment environment, for example as CHARTKIT_API_KEY. ChartKit keeps only a hash and cannot show it again.

A team can have up to 20 active keys. If nobody on your side has team admin access, ChartKit can issue a key for you. Write to support@getchartkit.app.

Send the key

Send the key in the Authorization header of every request. There is no token exchange and no expiry.

curl https://www.getchartkit.app/mcp \
  -H "Authorization: Bearer $CHARTKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

What a key can do

• Charts use the team palette that an admin saved on the team page. With no team palette saved, ChartKit's default colours apply.
• Tool calls need the team's licence to be active. When it lapses, every tool call returns an error result saying the licence is not active. The key itself stays valid, so calls work again once the licence is renewed.
• insert_chart_into_slides, list_open_decks and list_charts_in_deck are left out of tools/list, and calling one returns an error result. They act on a deck that a signed-in person has open in Chrome. Insert the chart with the Google Slides API instead, as the Python guide shows.

Revoke and rotate

Revoke a key from the same panel. Revocation takes effect immediately, and the next request with that key gets HTTP 401. To rotate a key without downtime:

1. Create a new key and store it next to the old one.

2. Deploy your service with the new key and check that its requests succeed.

3. Revoke the old key.

Keep keys safe

• Read the key from an environment variable or a secret manager. Never commit it to a repository or paste it into a notebook.
• Use keys only from server-side code. A key in browser JavaScript or a mobile app can be read by anyone who has the app.
• Create one key per service and environment, so you can revoke one without stopping the others.
• Rotate keys on a schedule and when someone with access to them leaves.
• If a key leaks, revoke it first, then issue a replacement.

Connect a client with a key

These examples read the key from the CHARTKIT_API_KEY environment variable. In the plain Claude Code command, your shell expands the variable once and Claude Code stores the key in its config. The project file form keeps only the variable name.

Coding tools and editors

claude mcp add --transport http chartkit https://www.getchartkit.app/mcp \
  --header "Authorization: Bearer $CHARTKIT_API_KEY"

Model APIs and HTTP

import os

import anthropic

client = anthropic.Anthropic()

response = client.beta.messages.create(
    model="claude-opus-5-5",
    max_tokens=16000,
    betas=["mcp-client-2025-11-20"],
    mcp_servers=[
        {
            "type": "url",
            "url": "https://www.getchartkit.app/mcp",
            "name": "chartkit",
            "authorization_token": os.environ["CHARTKIT_API_KEY"],
        }
    ],
    tools=[{"type": "mcp_toolset", "mcp_server_name": "chartkit"}],
    messages=[
        {
            "role": "user",
            "content": "Chart online sales 2021 to 2025 in EUR m: 41.2, 48.9, 57.3, 66.0, 78.4.",
        }
    ],
)
print(response.content)

Requests without a valid token

A missing, malformed, unknown or revoked token gets HTTP 401 before any JSON-RPC handling. This is the response to a request without a token.

HTTP/2 401
content-type: application/json
www-authenticate: Bearer realm="OAuth", resource_metadata="https://www.getchartkit.app/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token"

{"error":"invalid_token","error_description":"Missing or invalid access token"}