Coach Icarus API Authentication

Use the least access necessary for each integration.

The public agent discovery endpoint is read-only and does not require authentication. Account-specific Coach Icarus API endpoints require a bearer access token issued by the Coach Icarus authentication flow.

Authorization header

Authorization: Bearer <access-token>

Never place access tokens in a public page, URL query string, or source-controlled file. The machine-readable schema for the public agent API is available at /api/openapi.json.

Personal API keys (MCP server)

The hosted MCP server authenticates with personal API keys, not session bearer tokens. Generate a key in the dashboard under Settings → API keys and send it as an X-API-Key header or a Bearer token:

X-API-Key: ick_live_YOUR_KEY

The raw key is shown once at creation — store it in a secret manager. Keys are read-only, revocable at any time (revocation is immediate), and limited to ten active keys per account. Never commit a key to git or paste it into a shared file.