Skip to main content

Authentication

MCP and AI agents​

When using this API through the Wheelhouse MCP server, authenticate with OAuth (WorkOS AuthKit). Sign in with your Wheelhouse account through your MCP client's OAuth flow — the same credentials you use in the Wheelhouse app.

Do not send an RM API key yourself. The MCP server validates your OAuth token, resolves your user-specific RM API key, and attaches it as X-Integration-Api-Key on every upstream request. Your OAuth token is never forwarded to the RM API.

For enablement and client setup (Cursor, Claude, VS Code, and others), see MCP server. To install the MCP server together with portfolio skills, see Agent plugin.

Direct API integrations​

For HTTP integrations that call the RM API directly, send an RM API key in the X-Integration-Api-Key header. You can generate this in your Wheelhouse account under "Api Key". Each Wheelhouse user can hold up to 5 active RM API keys, and can create one only while holding fewer. A user who already held more before the limit keeps those keys. The key behind MCP access does not count toward the limit.

The RM API key is a single key that authenticates both the integration and user context — no separate user key is required.

curl https://api.usewheelhouse.com/ss_api/v1/listings \
  -H "X-Integration-Api-Key: YOUR_API_KEY"

Read-only API keys​

Keys configured as read-only may use the HTTP methods GET, HEAD, OPTIONS, and POST only. PUT and DELETE requests return 403 Forbidden with a message that the API key is read-only (other disallowed methods do as well). POST endpoints that create or modify data (such as creating a note) also return 403 Forbidden for read-only keys; only non-mutating POST endpoints (such as previews) are allowed.