Authentication

To use SpiderPublish outside the dashboard — from the CLI, an MCP agent, the editor extension, or the API directly — you need a token. This page covers how to get one and how authentication works.

Getting access

The simplest way to get a token is the request-and-approve flow from the CLI:

spideriq auth request --email you@yourcompany.com

This sends an approval request to your workspace admin. Once they approve, your credentials are issued and stored locally, and the CLI, MCP server, and extension all reuse them. Check your status any time with:

spideriq auth whoami

Token format

API requests authenticate with a bearer token made of three parts — your client id, an API key, and an API secret — combined as:

Authorization: Bearer <client_id>:<api_key>:<api_secret>

The CLI and MCP server handle this header for you once you are signed in; you only need it if you are calling the API directly.

Workspace binding

Most actions happen against a specific workspace and project. Bind a directory to your workspace once:

spideriq use <your-workspace>

This writes a spideriq.json file that the CLI, MCP server, and extension read on every call, so they always target the right site. You can optionally bind a specific project within the workspace if you run more than one site.

Scoping and safety

Every authenticated request is scoped to the workspace it is authorized for — there is no way to reach another workspace's content with your token. On top of that, destructive actions go through the preview-then-confirm flow, so even with a valid token nothing destructive happens without an explicit confirmation.

Keep your token safe

Treat your token like a password:

  • Store it as a secret in CI, never in committed code.

  • Do not paste it into shared chats or logs.

  • If a token is exposed, rotate it.

Tips

  • Sign in once per machine. Credentials are stored and reused across the CLI, MCP, and extension.

  • One spideriq.json per site keeps every tool pointed at the right workspace.

Next steps

  • CLI Reference — the commands the token unlocks.

  • MCP Setup — connect an MCP agent with these credentials.

  • Safe Publishing — the preview-then-confirm flow on destructive actions.

  • API Reference — calling the endpoints directly with the bearer token.