Docs

Authentication

How to authenticate with the Vergate API.

Vergate supports two authentication methods: API keys (for scripts, CI/CD, MCP) and JWT cookies (for the web dashboard).

#API Keys

API keys are used for all programmatic access — the MCP server, scripts, and direct API calls.

#Creating an API Key

  • 1

    Go to Settings

    Navigate to your project dashboard and click Settings in the sidebar.
  • 2

    Generate a key

    Click Create API Key. Give it a label (e.g., "CI/CD", "MCP").
  • 3

    Copy it immediately

    The raw key (pk_...) is shown only once. Copy it now — you cannot see it again.
    • Caution. If you lose your API key, you must create a new one. The raw value is never stored — only a hash.

    #Using Your API Key

    Pass it in the Authorization header:

    curl -H "Authorization: Bearer pk_your_key_here" \
     https://api.vergate.dev/api/v1/scan \
     -d '{"target_url": "https://example.com"}'

    Or use the X-API-Key header:

    curl -H "X-API-Key: pk_your_key_here" \
     https://api.vergate.dev/api/v1/scans

    #OAuth (Social Sign-in)

    You can sign in with Google, Microsoft, or GitHub. This creates a session cookie that the web dashboard uses. OAuth tokens are not the same as API keys — you cannot use them interchangeably.

    Warning. OAuth ≠ API Key. Signing in with GitHub gives you a login session, not an API key for scripts. You still need to create an API key in Settings for programmatic access.

    #JWT Session Tokens

    When you log in via the web dashboard (email/password or OAuth), a JWT session cookie is set. This is used automatically by the frontend — you don't need to manage it.

    #Token Lifetime

    Standard login: 7 days
    "Remember me" login: 30 days

    #MCP Server Authentication

    The MCP server uses your API key. Set it as an environment variable:

    .env or shell export
    export VERGATE_API_KEY="pk_your_key_here"
export VERGATE_BACKEND_URL="https://api.vergate.dev"
    Tip. The MCP server runs on your machine and talks to the Vergate cloud backend over HTTPS. Your API key never leaves your device except for API calls.