Authentication overview

Choose your auth method

Method	Use when	Where the secret lives	Detail page
JWT SSO	Logging your users into the widget, embed, or standalone page	Your server signs tokens with a private key from Settings → Developer	Single Sign-On
REST API key	Calling the Sleekplan API from your own backend	API key from Settings → Developer, sent as `Authorization: Bearer`	API keys
MCP OAuth 2.1	Connecting AI clients (Claude, Cursor, etc.) to your workspace	Issued by Sleekplan during the OAuth flow	MCP Server
Webhook secret	Verifying incoming webhook deliveries on your endpoint	You set a `?key=` GET parameter when you create the webhook	Webhooks
Canvas `X-Secret`	Verifying incoming Canvas requests on your endpoint	You set a secret token when installing the Custom Integration	Custom Integration overview

Treat both secrets like passwords. Never commit them to source control, expose them in client-side code, or share them in public channels.

Choosing the right method

Authenticate a logged-in user in the widget → JWT SSO.

Read or write Sleekplan data from your own backend → API key.

Let an AI assistant query Sleekplan in natural language → MCP OAuth.

React to events happening in Sleekplan → Webhook secret (a ?key= parameter in your endpoint URL).

Render custom UI inside the Sleekplan admin → Canvas X-Secret.

Choose your auth method