Skip to main content

​
Bearer tokens

Every story creation request needs an Authorization header with your API key:
POST /stories requests without a valid key return 401 Unauthorized. GET /stories/{id} is public so clients and viewers can poll a known story ID.

​
Creating an API key

1

Sign in to the dashboard

Visit pullstory.com/dashboard and sign in with GitHub.
2

Open API Keys

Navigate to pullstory.com/dashboard/api-keys.
3

Click 'Create key'

Give it a descriptive name (e.g. “CI pipeline” or “Claude Code MCP”). The full secret is shown only once — copy it immediately.
4

Store it securely

Put it in a secret manager, .env.local, or your CI provider’s secrets UI. Never commit it to a repo.

​
Key prefixes

​
Permissions

Every key is scoped to your user account and respects the same plan limits as the web dashboard. A key can:
  • Create pull stories from structured briefs
A key cannot access other users’ data.

​
Revoking a key

Revoking happens instantly — any in-flight request using that key will fail on the next call.
If a key is leaked, revoke it immediately and issue a new one. Generation requests made with the leaked key between leak and revocation still count against your minute quota.

​
Rotating keys

There’s no forced rotation, but best practice:
  • One key per integration (Claude Code MCP, CI, internal scripts)
  • Rotate every 90 days for production keys
  • Rotate immediately on team member departure

​
Next steps

Quickstart

Make your first authenticated request.

MCP setup

Wire the API into Claude Code.