# Auth

All `/api/v1` routes require a Bearer API key.

```http
Authorization: Bearer fr_live_...
```

## Rules

1. Missing or invalid secret → `401`
2. Key workspace ≠ path `workspaceId` → `403` Workspace mismatch
3. Missing required scope → `403` Insufficient scope
4. Bucket not in key's `bucketIds` (when non-empty) → `403` Bucket not allowed
5. Creator not on intelligence dogfood allowlist → `404` Not found

## Creating keys

Settings → API keys. Presets and custom scopes: [API keys](/docs/api-keys).

## MCP

The MCP server at `/api/mcp` uses the same Bearer keys and scope checks. See [MCP auth](/docs/mcp/auth).