> ## Documentation Index
> Fetch the complete documentation index at: https://docs.htmldrop.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API tokens for automation, OAuth for agents, and which endpoints need neither.

The API lives at `https://htmldrop.app/api/v1`. There are three ways to call it.

## No credentials

[Anonymous drop endpoints](/api/anonymous-drops) need nothing at all — that is
what powers the homepage drop area. Those drops are capped at 2 MB and live 7
days.

## API token

For scripts, CI and headless agents. Create one at
[Dashboard → Settings → API tokens](https://htmldrop.app/dashboard/settings);
tokens look like `hsk_live_…` and are shown once.

```bash theme={null}
curl https://htmldrop.app/api/v1/sites \
  -H "Authorization: Bearer $HTMLDROP_API_TOKEN"
```

A token carries the full rights of the account that created it. Store it as a
secret, never commit it, and revoke it from the same settings page if it leaks.

## OAuth

For MCP clients. The server implements OAuth 2.1 with PKCE and dynamic client
registration, so a compliant client discovers everything it needs:

```
https://htmldrop.app/.well-known/oauth-authorization-server
https://htmldrop.app/.well-known/oauth-protected-resource
```

Scopes are `mcp` and `cli`. You approve in the browser, the client stores and
refreshes tokens, and access can be revoked from the dashboard. See
[publishing from AI agents](/agents/overview).

## Rate limits and abuse controls

Anonymous publishing is rate limited per IP and per browser session, and uploads
pass an invisible bot check plus a phishing heuristic. Authenticated calls are
governed by your plan's limits rather than these controls — signing in is the
right fix for hitting an anonymous cap.