Authentication and security
How the tools sign in, what they can reach, and where your data goes.
Updated October 31, 2026
Two ways to sign in
| API key | Your CostCrunch login | |
|---|---|---|
| How | COSTCRUNCH_API_KEY, or cost auth login --api-key | cost auth login (browser, Google) or --email |
| Lasts | Until revoked | Refreshed automatically while you use it |
| Companies | The one it was made in | Any you belong to |
| Best for | AI assistants, scripts, CI | Using the CLI yourself |
If both are set, the API key wins. cost auth status shows which one is in use.
What the tools can reach
- Only your company's data, exactly what you can see in the app. CostCrunch checks this on every request, on its servers.
- Only reads. Requests that would change anything are refused, whatever tool sends them.
Where your data goes
The CLI, the Python package, and the MCP server run on your computer and talk to CostCrunch over HTTPS.
When you connect an AI assistant, the results of the questions it asks are sent to that assistant's provider (for example Anthropic for Claude, or Cursor) as part of the conversation, under your agreement with them. Connect only the assistants your company is comfortable sharing purchasing data with.
Stored credentials
cost auth login saves your session or key in ~/.config/costcrunch/credentials.json, readable only by your user account. cost auth logout deletes it.
The HTTP API
The tools call the CostCrunch API at https://api.costcrunch.ai, sending the key as a bearer token:
curl -H "Authorization: Bearer $COSTCRUNCH_API_KEY" https://api.costcrunch.ai/api-keys/current
That endpoint tells you which key, user, and company a key belongs to. The other HTTP endpoints aren't a published, versioned contract yet, so for anything else, use the Python package or the CLI. They're kept in step with the API.
Didn't answer your question?
Email [email protected]