Skip to main content
The Gumloop API supports OAuth and API keys. Each endpoint declares which credentials and OAuth scopes it accepts. Requests also require the applicable resource access, role permissions, and plan; having a valid credential does not bypass those checks.

API key

For scripts and integrations you control end to end. Generate a personal key in the Gumloop API key row of your Profile settings page. To get there, open Settings → Profile. Pass the key as a bearer token. For step-by-step help, see Find your Gumloop API key.

Personal vs team keys

Gumloop has two kinds of API key, and each one lives on the settings page of whoever owns it:
  • Personal key: the Gumloop API key row on your Profile settings page.
  • Team key: the Gumloop Team API key row on the team’s Settings page. In the left sidebar, right-click the team under Teams and choose Settings, or open the team and select Settings in its menu. Org admins can also open Settings → People & Access → Teams, and select the team. Team members can view and copy the key. Only team admins can generate, regenerate, or revoke it.
Passing a member’s user_id with a team API key does not authorize that member’s personal connector accounts. Every team member can copy a team key, so it proves the team, not a person. A team key works on endpoints that read what the team can access:
  • Listing teams, models, agents, and skills
  • Reading an agent, its versions, knowledge sources, guardrails, MCP servers, and evaluation settings
  • Listing and downloading the team’s artifacts and skills
Every other endpoint refuses it with 403 and personal_credential_required (“A team API key acts as the team. Use a personal API key or sign in to act as a member.”). That includes creating or changing agents, starting sessions, sending messages, triggers, and connector calls (/api/v1/mcp/*). To reach a team’s connector accounts, use a personal API key and pass team_id. The call then runs under your own limits.
The API parameter is still named project_id for backwards compatibility. It’s the same thing the UI now calls your team ID.
You can find your user_id in the User ID row of the Profile settings page, just above Gumloop API key. See Finding your user ID for details.

OAuth 2.0

If you’re building an app that other Gumloop users sign in to, use OAuth 2.0. Once you’ve completed the flow and have an access token, pass it the same way:
OAuth access to the Gumloop API requires the Pro plan or above. A token for an account below Pro is refused with 403 and the error tier_required_pro. API keys do not have this plan check.