# Feature AI-28 - Allow to use API Keys as Bearer tokens

Project: Stream AI
Status: closed
URL: https://community.openproject.org/work_packages/AI-28

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-11-14 – 2026-03-31 |
| Priority | Medium |
| Target versions | 17.2.0 |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module | API, Authentication, Artificial Intelligence / MCP Server (MCP) |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Labor costs |  |

## Description

**As** a user  
**I want to** use API keys as bearer tokens,  
**so that** I can easily copy & paste them into tools that ask me to specify an HTTP header.

**Acceptance criteria**

  - API Keys (personal access tokens) can be passed as Bearer tokens and are accepted

  - Passing API Keys via HTTP Basic auth is still possible

  - Any API keys generated in the past must at least work via HTTP Basic auth

**Context**

Some MCP clients, such as Claude Code, don't properly support registering themselves as static OAuth clients. They would support dynamic client registration, but that's rather complex for us to implement and brings additional risks.

On the other hand, those clients usually support adding simple keys/tokens that are valid for a longer period of time. This is what OpenProject offers through API keys. The only problem is that these can so far only be passed via HTTP Basic auth, which makes copy\&pasting them harder (or for clients only supporting Bearer tokens: impossible).

**QA Notes**

  - This can be tested on any APIv3 endpoint (choose your favorite one, e.g. `/api/v3/users/me`)

  - Create a new API token and use it in Postman (or any other tool) as a "Bearer token"
    
      - HTTP Header would be: Authorization: Bearer \<your-token\>