Skip to content

Authentication

How you prove who you are depends on the API and protocol. Pick the method that matches your integration.

API keysScoped, server-to-server keys for the Business API — a Bearer credential bound to one business.Business · GraphQLOAuthThe handshake AI assistants use to reach the MCP servers as a signed-in account, over PKCE.Public · Business · MCP

The MCP auth matrix

Three MCP servers, three auth postures:

sessions-dev — /build/api/mcp
No auth. Docs, schema search, and GraphQL validation only — nothing tenant-scoped.
sessions-public — /api/mcp
Anonymous for discovery and browsing; viewer tools (your own registrations) need an OAuth token with the mcp:account scope.
sessions-business — /@handle/api/mcp
Always authenticated: a staff session cookie/JWT, an OAuth token with the mcp:business scope, or — headlessly — an API key granted mcp:business. Every path resolves to a real staff user; the schema enforces that user's role.