Authentication

Three ways to call the API. All resolve to the same permissions model.

None (anonymous)

Creating, reading, and writing unclaimed workbooks requires no credentials. Anyone with a workbook URL can edit that workbook. Anonymous traffic is rate limited per IP.

API keys

Keys look like sk_live_ followed by 64 characters. Pass one in the x-api-key header. Requests act as the key's owner: workbooks you create are claimed and permanent.

curl https://sheets.fast/api/v1/workbooks -H 'x-api-key: sk_live_...'

OAuth 2.1

sheets.fast is its own OAuth authorization server. MCP clients (Claude, ChatGPT) and the CLI use it. Access tokens go in the Authorization: Bearer header. Authorization server metadata: /.well-known/oauth-authorization-server/api/auth.

CLI login

sheets login    # opens your browser; approve the device code
sheets whoami   # confirms who you are
sheets logout   # forgets stored credentials

Credentials are stored in ~/.config/sheets-fast/credentials.json with 0600 permissions. An explicit SHEETS_FAST_API_KEY takes precedence over a stored login.

Access model

  • Unclaimed workbook: anyone with the ID can read and write it.
  • Claimed workbook: members of its workspace only.
  • Claiming: open an unclaimed workbook's URL while signed in and select Claim.