Authentication
Beta
Create and use EchoPM org API keys for REST v1 and MCP.
Create a key#
- Sign in to the manager app with integration permissions
- Open Developers → API keys
- Choose REST API or MCP
- Copy the full secret immediately — EchoPM shows it only once
Create machine keys only in Developers. Website embeds use a separate publishable embed key on each property (Listing → Website embed).
If you still have an older key that starts with ecpm_, it continues to work. Create a new key when you rotate.
Key types#
| Key type | Use | Notes |
|---|---|---|
| REST | /api/v1/* | rest:read (GET) · rest:write (POST/PATCH/DELETE) |
| MCP | HTTP MCP portfolio tools | portfolio:read · Cursor / Claude / Windsurf |
| Embed | Iframe / @echopm/react | Publishable; create on the property, not here |
REST keys cannot call MCP or embeds. MCP keys cannot call REST. Embed keys cannot call machine APIs.
REST requests#
curl -s -H "Authorization: Bearer YOUR_ORG_API_KEY" \
"https://manager.echopm.app/api/v1/properties"
MCP requests#
MCP clients send the same Bearer token to the HTTP MCP endpoint. See MCP overview and Cursor setup.
OAuth (beta)
MCP clients that support OAuth discovery can use authorization code + PKCE:
- Metadata:
https://mcp.echopm.app/.well-known/oauth-authorization-server - Authorize (manager, signed-in session):
/api/developers/mcp/oauth/authorize - Token:
POST https://mcp.echopm.app/oauth/token
Access tokens are short-lived (mcpat_*). API keys remain the supported path for Cursor/Claude manual config today.
Security#
- Store REST and MCP secrets in environment variables or a secrets manager
- Rotate periodically; revoke unused keys in Developer Center
- Never commit machine secrets to git
- Publishable embed keys may appear in HTML; restrict them with allowed domains