Set up user-owned access

ToolPlexer API keys are bearer credentials. Keep the credential exchange and all API calls on your server.

1. Connect the account

Have the user create or provide a ToolPlexer key through your product's secure connection flow. Store it encrypted and associate it with the user account.

2. Resolve the active workspace

Call GET /v1/whoami with the credential and display the returned workspace label in your connection settings. Do not expose the raw key.

curl https://api.toolplexer.com/v1/whoami \
  -H "Authorization: Bearer <user-server-side-key>"

3. Call capabilities on the user's behalf

Use the same discover, inspect, run, and runs endpoints described in the API reference. Enforce your product's authorization before forwarding each request.

4. Handle disconnects and revocation

Treat 401 responses as a disconnected account. Delete your stored credential when the user disconnects and ask them to reconnect rather than retrying blindly.

If your product needs formal OAuth client registration, coordinate with the ToolPlexer team before shipping the flow.