Bearer API keys and scope enforcement·View as Markdown

Auth

All /api/v1 routes require a Bearer API key.

Authorization: Bearer fr_live_...

Rules

1. Missing or invalid secret → 401
2. Key workspace ≠ path workspaceId → 403 Workspace mismatch
3. Missing required scope → 403 Insufficient scope
4. Bucket not in key's bucketIds (when non-empty) → 403 Bucket not allowed
5. Creator not on intelligence dogfood allowlist → 404 Not found

Creating keys

Settings → API keys. Presets and custom scopes: API keys.

MCP

The MCP server at /api/mcp uses the same Bearer keys and scope checks. See MCP auth.