API keys, scopes, and bucket allowlists·View as Markdown

MCP auth & scopes

Bearer key

Every MCP request must include:

Authorization: Bearer fr_live_...

Same secrets as REST. Create them in Settings → API keys.

Scopes

Each tool checks the scopes listed in Tools. Grant the minimum your agent needs — e.g. Agent read-only preset for list_* + ask_agent without write/upload.

Full matrix: Errors & scopes.

Bucket allowlists

If the key has non-empty bucketIds, tools that touch other buckets fail. list_buckets only returns allowed buckets.

Dogfood gate

Keys created outside the intelligence allowlist cannot use MCP (same as REST). Failures look like auth/not-found, not a public feature flag.

OAuth

Not in this pass. Bearer API keys only.