# MCP auth & scopes

## Bearer key

Every MCP request must include:

```http
Authorization: Bearer fr_live_...
```

Same secrets as REST. Create them in Settings → API keys.

## Scopes

Each tool checks the scopes listed in [Tools](/docs/mcp/tools). Grant the minimum your agent needs — e.g. **Agent read-only** preset for `list_*` + `ask_agent` without write/upload.

Full matrix: [Errors & scopes](/docs/api/errors).

## Bucket allowlists

If the key has non-empty `bucketIds`, tools that touch other buckets fail. `list_buckets` only returns allowed buckets.

## Dogfood gate

Keys created outside the intelligence allowlist cannot use MCP (same as REST). Failures look like auth/not-found, not a public feature flag.

## OAuth

Not in this pass. Bearer API keys only.