Skip to main content

Authentication

MCP and AI agents​

When using this API through the Wheelhouse MCP server, authenticate with OAuth (WorkOS AuthKit). Sign in with your Wheelhouse account through your MCP client's OAuth flow — the same credentials you use in the Wheelhouse app.

Do not send an RM API key yourself. The MCP server validates your OAuth token, resolves your user-specific RM API key, and attaches it as X-Integration-Api-Key on every upstream request. Your OAuth token is never forwarded to the RM API.

For enablement and client setup (Cursor, Claude, VS Code, and others), see MCP server.

Direct API integrations​

For HTTP integrations that call the RM API directly, send an RM API key in the X-Integration-Api-Key header. You can generate this in your Wheelhouse account under "Api Key".

The RM API key is a single key that authenticates both the integration and user context — no separate user key is required.

curl https://api.usewheelhouse.com/ss_api/v1/listings \
  -H "X-Integration-Api-Key: YOUR_API_KEY"

Read-only API keys​

Keys configured as read-only may use the HTTP methods GET, HEAD, OPTIONS, and POST only. PUT and DELETE requests return 403 Forbidden with a message that the API key is read-only (other disallowed methods do as well). POST endpoints that create or modify data (such as creating a note) also return 403 Forbidden for read-only keys; only non-mutating POST endpoints (such as previews) are allowed.