Sign-in and API keys

Signing in

An MCP client that supports sign-in – Claude, ChatGPT, Claude Code, Cursor, Codex – opens a Pirate Skills page the first time a tool needs you. The page names the app that is asking; you check it and click Allow. The public tools work before that.

For client builders: the server's sign-in is described at /.well-known/oauth-protected-resource/mcp, and auth.md explains it in words.

What an API key does

A key is you, for a program. A script, a cloud session or the CLI sends it, and Pirate Skills treats the call as coming from you: it can read your wallet, access, profile and bookings, register you for a free event or cancel it, join Forge sessions, book an hour with Ben with one of your diamonds, and start a checkout link.

What it can never do

• Pay. A checkout is a Stripe link you open and complete yourself.
• See anybody else's data. No tool takes another person's id or email.
• Open the admin tools.
• Run for free. Each tool call costs 1 gold from your wallet, so you can see every call in your history.

Make one, keep it safe

1. Sign in and open Settings → Manage account → API keys.
2. Add a key with a name you will recognise and an expiry. Copy it – it is shown once.
3. Store it as PIRATESKILLS_API_KEY in your environment or secret store, never in code.
4. Revoke it in the same place the moment you stop using it or it leaks.

Sending it

-H "Authorization: Bearer $PIRATESKILLS_API_KEY"

The optional x-agent-client header names your client, so the person sees it in their wallet history.