Developers

API keys, the REST API, and the MCP server: how to authenticate, what you can call, and how to connect an AI client.

Everything in the app is reachable from outside it: a REST API for scripts and CI, and an MCP server so AI clients such as Cursor and Claude can read and update your program. Both live on the same host, share one permission model, and record every call in the organization's activity log.

Two ways to authenticate

MethodBest forHow you get itWho can set it up
OAuthInteractive MCP clients (Cursor, Claude, ChatGPT, Copilot, and others)The client opens a Noru sign-in; you pick an organization and approve scopes. Nothing to copy.Any member. Scopes are capped by your role.
API keyREST calls, CI pipelines, scripts, and headless MCP clientsAn admin creates it under SettingsDeveloper; the secret is shown once.Admins only

Viewers can only hold read scopes, whichever method they use. An API key acts as the admin who created it, but only inside the organization it was created in.

Endpoints

WhatURL
REST base URLhttps://api.noru.tech
MCP endpointPOST https://api.noru.tech/v1/mcp
OpenAPI documenthttps://api.noru.tech/openapi
Interactive API referencehttps://api.noru.tech/
Markdown spec for LLMshttps://api.noru.tech/llms.txt
OAuth authorization server metadatahttps://app.noru.tech/.well-known/oauth-authorization-server

API keys

Create a scoped, optionally expiring key and use it as a bearer token.

REST API

Resources, pagination, errors, rate limits, and a first request.

MCP server

Tools, resources, prompts, the OAuth flow, and how scopes follow roles.

MCP client setup

Per-client instructions for Cursor, Claude, ChatGPT, Copilot, and more.

Last updated on

API keys

Create scoped, expiring API keys and use them as bearer tokens for REST and headless MCP access.

On this page

Two ways to authenticateEndpointsPopular tasks