API keys and OAuth both authenticate requests, but they answer different questions. A key asks whether this is a trusted caller. OAuth asks whether this user approved this app to act for them.
Use an API key when
- Your own backend is the caller and can keep a secret.
- You want the simplest possible setup: send a header, done.
- There's no third-party app acting on a user's behalf.
For browser use, a scoped, domain-locked publishable key is the safe middle ground. It can do one narrow thing and nothing else.
Use OAuth when
- A third-party app (or an AI client) needs to act for a user.
- Users should grant and revoke access without sharing a secret.
- You need per-user scoping and consent.
How ContactAPI uses both
Secret and publishable keys authenticate the REST API. The MCP server uses OAuth 2.1, because there an AI client is acting on a user's behalf and should ask permission rather than hold a key. Same data, two auth models, each matched to the caller.
Where ContactAPI fits
ContactAPI is an open-source REST API for saving and managing contacts. You POST an email plus any JSON fields, get simple CRUD back, and can reach the same data from an AI client over its MCP server. No CRM, no pipeline stages, no lock-in.