API keys, scopes, and bucket allowlists·View as Markdown

MCP auth & scopes

Bearer key

Every MCP request must include:

Authorization: Bearer fr_live_...

Same secrets as REST. Create them in Settings → API keys.

Each tool checks the scopes listed in Tools. Grant the minimum your agent needs.

Agent read-only — list_* + ask_agent without write/upload
Upload + read — presign_upload + complete_upload + list/download. Does not include files:write (tags, mkdir, move)

Registration after PUT is files:upload, not files:write. See Upload flow.

If the key has non-empty bucketIds, tools that touch other buckets fail. list_buckets only returns allowed buckets.

Keys created outside the intelligence allowlist cannot use MCP (same as REST). Failures look like auth/not-found, not a public feature flag.

Not in this pass. Bearer API keys only.