Authentication - CloudShip AI

Local Mode

When Station runs in local mode (local_mode: true), no authentication is required:

curl http://localhost:8585/api/v1/agents

CloudShip Mode

When connected to CloudShip (local_mode: false), use one of these methods:

Bearer Token

curl -H "Authorization: Bearer your-token" \
  http://localhost:8585/api/v1/agents

API Key

Generate an API key in Station settings:

curl -H "X-API-Key: stn_xxx" \
  http://localhost:8585/api/v1/agents

MCP Authentication

The MCP server (port 8586) uses OAuth when in CloudShip mode.

OAuth Flow

OAuth Configuration

Station advertises OAuth configuration:

{
  "oauth": {
    "authorization_url": "https://app.cloudshipai.com/oauth/authorize",
    "token_url": "https://app.cloudshipai.com/oauth/token",
    "client_id": "station-mcp",
    "scopes": ["mcp:read", "mcp:execute"]
  }
}

Token Scopes

Scope	Permissions
`read`	List agents, tools, runs
`write`	Create/update agents
`execute`	Run agents
`admin`	Full access

Creating API Keys

Via CLI

stn auth create-key --name "CI Pipeline" --scopes "read,execute"

Via API

curl -X POST http://localhost:8585/api/v1/auth/keys \
  -H "Authorization: Bearer admin-token" \
  -d '{"name": "CI Pipeline", "scopes": ["read", "execute"]}'

Revoking Keys

stn auth revoke-key stn_xxx

Or via API:

curl -X DELETE http://localhost:8585/api/v1/auth/keys/stn_xxx \
  -H "Authorization: Bearer admin-token"

​Local Mode

​CloudShip Mode

​Bearer Token

​API Key

​MCP Authentication

​OAuth Flow

​OAuth Configuration

​Token Scopes

​Creating API Keys

​Via CLI

​Via API

​Revoking Keys