> ## Documentation Index
> Fetch the complete documentation index at: https://docs.darwin.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use scoped API keys for SDK and CLI access, and OAuth for MCP.

## API, SDK, and CLI

Use a Darwin developer API key as an HTTP Bearer token:

```http theme={null}
Authorization: Bearer darwin_...
```

Keys are owned by one Darwin user, stored as one-way hashes, scoped to explicit capabilities, independently revocable, and optionally expiring.

| Scope               | Access                                       |
| ------------------- | -------------------------------------------- |
| `agent:read`        | Read the owner's personal-agent conversation |
| `agent:write`       | Send messages to the owner's personal agent  |
| `goals:read`        | Read the owner's goals                       |
| `goals:write`       | Create goals                                 |
| `approvals:read`    | Read pending and completed approvals         |
| `approvals:write`   | Approve or reject an owned request           |
| `integrations:read` | Inspect the owner's integrations and skills  |

## MCP

MCP clients use browser-based OAuth at `https://darwin.so/mcp`. Do not paste an API key into an MCP client.

## Owner scoping

Darwin derives the user from the credential. User IDs, connection IDs, and authority claims supplied by a model or request body never change the authenticated owner.

<Tip>
  Issue separate keys for separate applications so each key can have the narrowest scopes and be revoked independently.
</Tip>