API, SDK, and CLI
Use a Darwin developer API key as an HTTP Bearer token:
Keys are owned by one Darwin user, stored as one-way hashes, scoped to explicit capabilities, independently revocable, and optionally expiring.
MCP
MCP clients use browser-based OAuth at https://darwin.so/mcp. Do not paste an API key into an MCP client.
Owner scoping
Darwin derives the user from the credential. User IDs, connection IDs, and authority claims supplied by a model or request body never change the authenticated owner.
Issue separate keys for separate applications so each key can have the narrowest scopes and be revoked independently.