Authentication
One account, three authentication mechanisms — each surface uses the one that fits it:
| Surface | Mechanism | You manage |
|---|---|---|
| REST API | API key (Bearer token) | Keys in the console |
| MCP server (and plugin) | OAuth sign-in | Nothing — sign in once per client |
| App & console | Browser sign-in | Your account credentials |
API keys (REST API)
Create keys from the console dashboard and send them as a Bearer token on every request:
Code
Key facts:
- Up to 10 active keys per account. Use separate keys per application or environment so you can revoke one without breaking the others.
- Keys are secrets. Anyone holding a key can spend your credits. Keep them out of client-side code, repositories, and logs; store them in environment variables or a secret manager.
- Rotation is delete + create. Revoke a key in the console and it stops working immediately.
All usage across all keys draws on the same credit balance, and every request is attributed in the console's usage view.
OAuth (MCP server and plugin)
The MCP server does not use API keys. When you connect an MCP client — ChatGPT, Claude, Cursor, or any other host — it opens a browser window to sign in with your Ultralayer account, and the client holds a scoped token from then on.
What this means in practice:
- Nothing to copy or store. There is no key to paste into an MCP client, and nothing to leak.
- Per-client authorization. Each connected client authorizes separately; disconnecting one doesn't affect the others.
- Same account, same credits. MCP usage is billed to the same balance as API usage and appears in the same usage history.
Setup walkthroughs are in the integration guides.
App and console
app.ultralayer.ai and console.ultralayer.ai use standard browser sign-in. The app also allows limited anonymous use so you can try core features before creating an account.