Skip to main content

​
Authentication

MCP initialization, tool discovery, and public model discovery do not require authentication. Account access and all paid MCP or CLI execution requests require a PoYo API key.
A successful model search does not confirm that the configured API key is valid. Use poyo_account or poyo auth status to verify authentication.

​
CLI

Store the key in the system keyring:
For an ephemeral environment:
export POYO_API_KEY=... (or $env:POYO_API_KEY=... in PowerShell) applies only to the current terminal session. Apps launched from the desktop, such as Cursor, VS Code, or the Codex app, do not see it. auth login avoids this for CLI and Agent Skill use. Credential priority is --api-key, POYO_API_KEY, system keyring, then local config fallback. An old or invalid POYO_API_KEY overrides the key saved by auth login. Run poyo auth status to see the source in use, such as (environment) or (keyring).

​
Security

  • Never include a key in an MCP URL or prompt.
  • Never commit a key to MCP configuration.
  • Prefer environment interpolation when configuring a client.
  • Apply API-key model and credit limits in the PoYo dashboard.

​
Authentication failures

REST requests use an HTTP 401 response:
MCP business and authentication failures are returned as Tool Results with isError: true, even when the MCP HTTP transport itself returns 200. Clients should inspect the tool result instead of relying only on the HTTP status.