API Authentication | Gazebo Docs

The Gazebo REST API uses bearer tokens for authentication. The same token that authenticates an MCP connection authenticates REST API calls.

Authorization header

Include the token in every request:

Authorization: Bearer ag_your_token_here

Base URL

https://app.gazebohq.com/api

Example request

curl https://app.gazebohq.com/api/agents/me/credentials?method=GET \
  -H "Authorization: Bearer ag_your_token_here"

Error responses

HTTP status	Meaning
`401 Unauthorized`	Token missing, malformed, or invalid
`403 Forbidden`	Token is valid but the agent lacks permission for the requested operation
`404 Not Found`	Resource doesn't exist or the agent doesn't have visibility into it

All error responses use JSON:

{
  "status": "denied",
  "service": "stripe",
  "reason": "Method DELETE is not permitted for service stripe",
  "next_action": "Update the agent's access profile in the Gazebo dashboard."
}

Obtaining a token

Tokens are issued when you create an agent in the Gazebo dashboard. See Bearer tokens for the full token lifecycle.

Token scope

Each token is tied to a specific agent and its access profile. A token cannot be used to access services outside the agent's declared profile, regardless of what the request asks for.

The Gazebo REST API uses bearer tokens for authentication. The same token that authenticates an MCP connection authenticates REST API calls.

Authorization header

Include the token in every request:

Authorization: Bearer ag_your_token_here

Base URL

https://app.gazebohq.com/api

Example request

curl https://app.gazebohq.com/api/agents/me/credentials?method=GET \
  -H "Authorization: Bearer ag_your_token_here"

Error responses

HTTP status	Meaning
`401 Unauthorized`	Token missing, malformed, or invalid
`403 Forbidden`	Token is valid but the agent lacks permission for the requested operation
`404 Not Found`	Resource doesn't exist or the agent doesn't have visibility into it

All error responses use JSON:

{
  "status": "denied",
  "service": "stripe",
  "reason": "Method DELETE is not permitted for service stripe",
  "next_action": "Update the agent's access profile in the Gazebo dashboard."
}

Obtaining a token

Tokens are issued when you create an agent in the Gazebo dashboard. See Bearer tokens for the full token lifecycle.

Token scope

Each token is tied to a specific agent and its access profile. A token cannot be used to access services outside the agent's declared profile, regardless of what the request asks for.