Authentication

API keys for your code, a sign-in for AI assistants, and who in your team can use which.

​

API keys

Your code authenticates with an API key, sent as a bearer token:

Authorization: Bearer dsk_live_...

• Create keys on the Developers page. Owners and admins of a paid plan can create them.
• A key is shown once. We only store a hash of it, so we can’t show it again. If you lose one, revoke it and create another.
• A key acts as the person who created it, inside their organization, and uses that plan’s minutes. If that person leaves the organization or is deactivated, the key stops working.
• An organization can have up to 10 active keys. Revoking a key takes effect immediately.

Keep keys on your server. Never put an API key in a web page, a mobile app or a public repository.

​

AI assistants

Claude, ChatGPT and other assistants don’t use API keys. They connect to the MCP server and ask you to sign in to Demosmith and allow access, the same way you’d connect any other app. See Connect an AI assistant.

The access they get is one of two scopes:

Scope	Allows
demos:read	See demos, options and status
demos:write	Create, answer and cancel demos

You can see and disconnect connected assistants on the Developers page at any time.

​

Who can do what

	Owner	Admin	Editor	Viewer
Create and revoke API keys	✓	✓
Manage webhooks and the signing secret	✓	✓
Connect an AI assistant	✓	✓	✓

​

Hosts

Host	Used for
https://platform.demosmith.ai/v1	The REST API, with API keys
https://mcp.demosmith.ai/mcp	The MCP server, for AI assistants
https://app.demosmith.ai	The web app, where people sign in, answer the agent and watch demos

API keys and assistant tokens work only on the first two. They are refused everywhere else.