Cerber

TG Cerber API

Authentication

Every request carries a bearer token in the Authorization header. Two kinds are accepted: API keys and OAuth 2.1 access tokens. Either one acts as one admin of one organization.

API keys

Create one in the admin console: profile menu → Developer → API keys. Choose a label, the scopes and an expiry (90 days by default). The key is shown once, when it is created — store it in a secret manager; it cannot be shown again. Keys start with cer_live_.

Creating a key with any write scope asks for your console password.

A key works only in the organization it was created in and never beyond its creator's role and access, as they are at the moment of each request; disabling that admin stops it. When the key's owner changes their console password, the key stops working — create a new one. Revoke a key on the Developer page at any time.

Never put a key into a web page or a mobile app: anyone who can read it can act as you.

GET /v1/organization

curl "https://admin.tgcerber.com/v1/organization" \
  -H "Authorization: Bearer $TGCERBER_API_KEY"

OAuth 2.1

For applications that act for an admin who signs in and approves — this is how Claude and ChatGPT connect.

  • Authorization code flow with PKCE (code_challenge_method=S256 is required).
  • Dynamic client registration at POST https://admin.tgcerber.com/oauth/register (redirect URIs must be https://…, or http://localhost / http://127.0.0.1).
  • Discovery: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource.
EndpointURL
Authorizehttps://admin.tgcerber.com/oauth/authorize
Tokenhttps://admin.tgcerber.com/oauth/token
Revokehttps://admin.tgcerber.com/oauth/revoke
Registerhttps://admin.tgcerber.com/oauth/register

Resources: https://admin.tgcerber.com/mcp and https://admin.tgcerber.com/v1 — a token works only for the resource it was issued for.

Access tokens last 1 hour. Refresh tokens last 90 days and rotate: every refresh returns a new refresh token. Presenting a refresh token that was already used disconnects the whole connection (it is treated as a sign of theft).

On the consent screen the admin chooses which accounts the application may reach and which scopes it gets; write scopes ask for the console password.

An MCP request without a valid token gets 401 with WWW-Authenticate: Bearer resource_metadata="https://admin.tgcerber.com/.well-known/oauth-protected-resource/mcp" — that is how MCP clients discover the OAuth setup.