Authentication

API keys#

Every call to /v1 is made with an API key. Create one in Settings → Developer. Keys start with sd_, belong to your account, and are shown in full only once. The list in Settings shows each key's first characters and when it was last used, and you can revoke a key there at any time.

Send the key as a bearer token. An x-api-key header works too, for tools that can't set Authorization.

curl https://api.slingdrop.my/v1/me \
  -H "Authorization: Bearer $SLINGDROP_API_KEY"

import { Slingdrop } from "@slingdrop/sdk";

const sd = new Slingdrop({ apiKey: process.env.SLINGDROP_API_KEY });
const me = await sd.me(); // { id, email, name, plan, limits }

# Either sign in once (saves a key in ~/.config/slingdrop/config.json)
slingdrop login

# or pass a key, e.g. in CI
SLINGDROP_API_KEY=sd_… slingdrop whoami

Keys Slingdrop makes for you#

• slingdrop login creates a key named CLI on <your computer>. slingdrop logout forgets it locally; revoke it in Settings to switch it off.
• Signing in an MCP client with OAuth creates a key named MCP: <app name> (see below).
• The “try it” console on the API reference uses a temporary key that expires after an hour.

What each plan's keys can do#

Every signed-in plan, Free included, can use the whole API: create and manage drops, folders, file requests, reviews, webhooks and file hosting. Plans differ in how many calls a key can make per day and in the same limits the app enforces (drop size, storage, recipients and so on). Signed-out visitors can't create keys.

The daily allowance is a rolling 24-hour window counted per key. Over it, calls answer 429 with "code": "rate_limited". The full list is on Limits.

Authentication errors#

OAuth for MCP clients#

AI clients such as Claude, ChatGPT and Cursor connect to https://slingdrop.my/mcp and sign in with OAuth, so you never paste a key. Slingdrop runs a small OAuth 2.1 server for this:

• Discovery at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.
• Dynamic client registration at POST /api/oauth/register, so clients register themselves.
• Authorization code with PKCE (S256) only, scope slingdrop, public clients (no client secret). You approve the app on a Slingdrop consent screen at /oauth/authorize.
• The token endpoint, POST /api/oauth/token, returns an ordinary Slingdrop API key as the access token, with your plan's daily allowance. It's listed in Settings as MCP: <app name>, and revoking it there signs the app out.

Clients that can't do OAuth can send an API key instead: Authorization: Bearer sd_… on the remote server, or SLINGDROP_API_KEY for the local npx -y @slingdrop/mcp server. Setup for each client is in AI agents (MCP).

curl https://slingdrop.my/.well-known/oauth-authorization-server
# → { "issuer": "https://slingdrop.my", "authorization_endpoint": "https://slingdrop.my/oauth/authorize",
#     "token_endpoint": "https://slingdrop.my/api/oauth/token", "registration_endpoint": "https://slingdrop.my/api/oauth/register",
#     "code_challenge_methods_supported": ["S256"], "scopes_supported": ["slingdrop"], … }