What is the difference between an API key and OAuth?
An API key is a long-lived secret your server sends on every request to prove which account is calling. OAuth is a consent flow — approve access once, then hold a token instead of a password. Social Fetch REST uses x-api-key: sfk_…; hosted MCP uses OAuth so agents never store a static key in config.
What each one actually solves
An API key answers "which account is this?" One string, valid until revoked — suited to unattended server-to-server calls, dangerous anywhere a browser can see it.
OAuth answers "did a user approve this?" A login and consent screen yields a scoped, often short-lived token — built for cases where consent and revocability matter.
When API keys fit
Cron jobs, backend proxies, n8n/Pipedream nodes, batch scripts — anything unattended. Create an sfk_… key in the dashboard, store it in an environment variable, send x-api-key on every request. Credits charge to that account.
Treat it like a password. Don't embed in frontends, mobile binaries, or public repos. Rotate from the dashboard if it leaks.
When OAuth fits
Interactive agents — Claude, Cursor, VS Code — where a human approves once. Hosted MCP at https://api.socialfetch.dev/mcp uses OAuth so tool calls bill to your signed-in account without an sfk_ key in mcp.json.
Official platform kits (Instagram Graph, TikTok Login, LinkedIn partner APIs) use OAuth for owner-scoped platform data — separate from Social Fetch MCP OAuth, which only authenticates your Social Fetch account for public-data lookups.
A concrete example of the split
A nightly job pulling 500 TikTok follower counts: sfk_… key from env, REST or @socialfetch/sdk. A Claude Desktop agent looking up creators on demand: hosted MCP + browser OAuth — no key in config.
Whoami, balance, and Ask over MCP go through the same OAuth session.
How the industry generally splits this
Stripe uses secret keys for server charges and OAuth for Connect merchants. Google Cloud uses service-account keys for backends and OAuth when end-user data is involved. Same pattern: keys for systems acting on their own behalf, OAuth when a person's consent must be verifiable.
Common mistakes
Putting an API key where a browser can read it — move the call server-side, or use hosted MCP OAuth instead.
Assuming platform OAuth (TikTok, LinkedIn, Meta) substitutes for Social Fetch MCP OAuth. They're unrelated — neither replaces the other.
How Social Fetch splits them
REST, OpenAPI, and TypeScript SDK: API key via x-api-key. Hosted MCP: OAuth. See /docs/integrations/mcp and /docs/quickstart.
FAQ
Should I use an API key or OAuth?
API key for unattended REST/SDK calls. OAuth for interactive MCP clients.
Is OAuth required for Social Fetch?
No. REST and SDK use x-api-key. OAuth only for hosted MCP.
Can I use an API key with MCP?
Hosted MCP at https://api.socialfetch.dev/mcp uses OAuth, not a pasted key.
Do I need OAuth to call Social Fetch REST?
No. Send x-api-key with an sfk_… key from the API Keys dashboard.
Can I put my API key in Cursor MCP config?
Prefer hosted MCP with OAuth. For scripts, keep the key in server env vars.
Is platform OAuth (TikTok, LinkedIn, Meta) the same as Social Fetch OAuth?
No. Platform OAuth authorizes a member's account on that platform. Social Fetch MCP OAuth authorizes your Social Fetch account for tool calls.
Where do I create an API key?
Social Fetch app under API Keys. See /docs/quickstart and /docs/credits.
Why doesn't Social Fetch just use API keys for MCP too?
MCP clients run on developer machines where static keys leak easily into config files or git. OAuth keeps credentials as revocable session tokens.