What is the difference between an API key and OAuth?
An API key is a long-lived secret your server sends on every request to prove which account is calling. OAuth is a consent flow — approve access once, then hold a token instead of a password. Social Fetch REST uses x-api-key: sfk_…; hosted MCP uses OAuth by default, and the same x-api-key if the client cannot complete OAuth.
What each one actually solves
An API key answers "which account is this?" One string, valid until revoked — suited to unattended server-to-server calls, dangerous anywhere a browser can see it.
OAuth answers "did a user approve this?" A login and consent screen yields a scoped, often short-lived token — built for cases where consent and revocability matter.
When API keys fit
Cron jobs, backend proxies, n8n/Pipedream nodes, batch scripts — anything unattended. Create an sfk_… key in the dashboard, store it in an environment variable, send x-api-key on every request. Credits charge to that account.
Treat it like a password. Don't embed in frontends, mobile binaries, or public repos. Rotate from the dashboard if it leaks.
When OAuth fits
Interactive agents — Claude, Cursor, VS Code — where a human approves once. Hosted MCP at https://api.socialfetch.dev/mcp uses OAuth by default so tool calls bill to your signed-in account. If the client cannot complete OAuth, send the same x-api-key as REST.
Official platform kits (Instagram Graph, TikTok Login, LinkedIn partner APIs) use OAuth for owner-scoped platform data — separate from Social Fetch MCP OAuth, which only authenticates your Social Fetch account for public-data lookups.
A concrete example of the split
A nightly job pulling 500 TikTok follower counts: sfk_… key from env, REST or @socialfetch/sdk. A Claude Desktop agent looking up creators on demand: hosted MCP + browser OAuth.
Whoami, balance, and Ask over MCP go through the same signed-in account (OAuth or API key).
How the industry generally splits this
Stripe uses secret keys for server charges and OAuth for Connect merchants. Google Cloud uses service-account keys for backends and OAuth when end-user data is involved. Same pattern: keys for systems acting on their own behalf, OAuth when a person's consent must be verifiable.
Common mistakes
Putting an API key where a browser can read it — move the call server-side, or use hosted MCP OAuth instead.
Assuming platform OAuth (TikTok, LinkedIn, Meta) substitutes for Social Fetch MCP OAuth. They're unrelated — neither replaces the other.
How Social Fetch splits them
REST, OpenAPI, and TypeScript SDK: API key via x-api-key. Hosted MCP: OAuth by default, or the same x-api-key if the client cannot complete OAuth. See /docs/integrations/mcp and /docs/quickstart.
FAQ
Should I use an API key or OAuth?
API key for unattended REST/SDK calls. OAuth for interactive MCP clients. If the MCP client cannot complete OAuth, send x-api-key — see /docs/integrations/mcp.
Is OAuth required for Social Fetch?
No. REST and SDK use x-api-key. MCP uses OAuth by default and also accepts x-api-key.
Can I use an API key with MCP?
Prefer OAuth. If the client cannot complete OAuth, send x-api-key from an env var. See /docs/integrations/mcp.
Do I need OAuth to call Social Fetch REST?
No. Send x-api-key with an sfk_… key from the API Keys dashboard.
Can I put my API key in Cursor MCP config?
Prefer OAuth. If the client never prompts, set headers x-api-key from an env var. See /docs/integrations/mcp.
Is platform OAuth (TikTok, LinkedIn, Meta) the same as Social Fetch OAuth?
No. Platform OAuth authorizes a member's account on that platform. Social Fetch MCP OAuth authorizes your Social Fetch account for tool calls.
Where do I create an API key?
Social Fetch app under API Keys. See /docs/quickstart and /docs/credits.
Why doesn't Social Fetch just use API keys for MCP too?
OAuth is the default so keys are not sitting in config files. If the client cannot complete OAuth, send x-api-key from an env var. See /docs/integrations/mcp.