> ## Documentation Index > Fetch the complete documentation index at: https://docs.darwin.so/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > Choose the credential that matches application management, linked-agent work, or webhooks. Connect uses different credentials for different trust boundaries. Do not use one credential as a substitute for another. | Credential | Use it for | | ---------------------------------- | ------------------------------------------------------------------------------------ | | Connect API key or service account | Managing an application, ephemeral goals, application balance, and webhooks. | | Sign in with Darwin access token | Operating the agents a user explicitly linked to the application. | | First-party hosted session | User-owned funding, payout, provider OAuth, identity, and other owner-only controls. | | Webhook signing secret | Verifying that an event delivery came from Darwin. | Send API keys, service-account tokens, and OAuth access tokens as bearer credentials: ```http theme={null} Authorization: Bearer ``` Keep application credentials on a trusted backend. Never put them in browser code, mobile bundles, logs, URLs, or model-visible prompts. ## Linked-agent authorization Sign in with Darwin uses authorization code flow with PKCE. The access token is limited by the user's current application, agent, and scope grants. Darwin reevaluates those grants on every call, so access can stop before the token expires. ## Owner-only actions A Connect app cannot reuse the user's saved Darwin payment method, withdraw their earnings, or retrieve provider credentials. When an owner-only action is required, open the Darwin-hosted flow returned by the API. Implement authorization, account creation, agent selection, and consent.