# AppSkyline API authentication

> OAuth 2.0 and API-key authentication for AppSkyline. Canonical URL: https://www.appskyline.com/auth.md. Updated 2026-09-19.

## Try before you authenticate

No credential is needed to evaluate the API. `GET https://api.appskyline.com/api/sandbox/keywords` answers without any signup or key, and self-serve signup at https://app.appskyline.com/signup creates an account whose dashboard issues scoped API keys instantly — there is no sales or approval step.

## Discover

Fetch protected-resource metadata from https://www.appskyline.com/.well-known/oauth-protected-resource and authorization-server metadata from https://api.authrice.com/.well-known/oauth-authorization-server.

## Pick a method

Use OAuth with PKCE when acting for a user through the AppSkyline MCP server. Use an API key for unattended REST automation.

## Register

OAuth public clients register dynamically at https://api.authrice.com/api/oauth/register. Set `token_endpoint_auth_method` to `none` and provide an exact HTTPS redirect URI.

## Claim

Send the user to https://app.appskyline.com/oauth/authorize with `response_type=code`, `client_id`, `redirect_uri`, `scope`, `state`, `code_challenge`, and `code_challenge_method=S256`.

## Use credential

Exchange the code at https://api.authrice.com/api/oauth/token with the original verifier. Send the bearer token to https://mcp.appskyline.com/mcp. REST API keys use HTTP Basic authentication with the key secret.

## Errors

A 401 means the credential is absent or invalid; 403 means the granted scope does not permit the tool or endpoint; 429 means wait for `Retry-After`.

## Revocation

Revoke either OAuth token by posting an `application/x-www-form-urlencoded` body containing `token=<token>` and the matching `token_type_hint` to https://api.authrice.com/api/oauth/revoke. The endpoint returns 200 even when the token is unknown. Revoking either token disconnects the authorization: the refresh-token family cannot mint again, and every access token already issued from that grant is rejected on its next MCP request. Delete local credentials after the server acknowledges revocation. Revoke an API key from the AppSkyline dashboard.

## Scopes

- `appskyline:read` reads apps, keywords, rankings, histories, results, listings, metadata, engagement, and reviews.
- `appskyline:write` adds and deletes tracked keywords. Write tools remain approval-gated.