# Loops authentication

Loops exposes a REST API and a hosted MCP server. They use different authentication methods.

## REST API

Send a Loops API key as a Bearer token to `https://app.loops.so/api`:

```http
Authorization: Bearer YOUR_API_KEY
```

Create keys in [Settings → API](https://app.loops.so/settings?page=api). Keys are scoped to a Loops team and must stay on the server. Do not put them in browser code, mobile apps, repositories, logs, or prompts.

Validate a key with:

```bash
curl https://app.loops.so/api/v1/api-key \
  -H "Accept: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

A valid key returns `200` with the team name. A missing or invalid key returns `401` as JSON.

The baseline limit is 10 requests per second per team. API responses include `X-RateLimit-Limit` and `X-RateLimit-Remaining`; a rejected request returns `429 Too Many Requests`.

## Hosted MCP server

Connect to `https://mcp.loops.so` with a client that supports Streamable HTTP and browser-based OAuth 2.0. Do not send a Loops API key to the MCP server.

Start with the protected-resource metadata:

```text
https://mcp.loops.so/.well-known/oauth-protected-resource
```

It identifies the resource as `https://mcp.loops.so/`, the authorization server as `https://app.loops.so`, and the supported scope as `mcp`.

Then read the authorization-server metadata:

```text
https://app.loops.so/.well-known/oauth-authorization-server
```

Loops supports the authorization-code grant with PKCE S256 and refresh tokens. Public MCP clients use an HTTPS Client ID Metadata Document as their `client_id`; the requested `redirect_uri` must exactly match one of the document's registered redirect URIs. The browser approval flow lets the user choose which Loops teams the client may access.

Loops does not currently advertise an `agent_auth` metadata block or support the agent-driven registration flows defined by the experimental auth.md protocol. An existing Loops account and interactive browser consent are required.

## References

- API documentation: https://loops.so/docs
- OpenAPI description: https://app.loops.so/openapi.json
- MCP setup: https://loops.so/agents/mcp
- Agent tooling: https://loops.so/agents