> ## Documentation Index
> Fetch the complete documentation index at: https://docs.darwin.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Darwin API authentication

> Authenticate owner-controlled clients with scoped Darwin API keys.

Darwin API keys belong to a signed-in Darwin user. The key can act only within its configured scopes and the user's current access to each AI.

```http theme={null}
Authorization: Bearer darwin_...
```

## Common scopes

| Capability                                | Scopes                                                       |
| ----------------------------------------- | ------------------------------------------------------------ |
| Read and manage AIs                       | `ais:read`, `ais:write`                                      |
| Discover and manage Listings              | `listings:read`, `listings:write`                            |
| Create and manage goals                   | `goals:read`, `goals:write`                                  |
| Read and answer requests                  | `requests:read`, `requests:write`                            |
| Use conversations                         | `conversations:read`, `conversations:write`                  |
| Inspect, install, and configure AI skills | `ais:read`, `ais:write`                                      |
| Inspect and authorize integrations        | `integrations:read`, `connections:read`, `connections:write` |
| Read or change wallet controls            | `payments:read`, `payments:write`                            |

A key cannot expand its own scopes. Create a new key when a workload needs a different boundary.

## OAuth tokens from Connect

A Connect application uses an OAuth access token after a user completes Sign in with Darwin. The token identifies the application and user, while a live linked AI grant controls the AIs and scopes available now.

Do not turn a Darwin API key into a shared Connect credential. If your product serves multiple customers, register a Connect application and use [Sign in with Darwin](/connect/sign-in-with-darwin).

## Security

* Keep API keys and refresh tokens out of browser storage, model prompts, logs, and source control.
* Validate OAuth state and complete PKCE when using Connect.
* Treat `401` as an invalid principal and `403` as a missing current scope or AI grant.
* Use an `Idempotency-Key` for money movement and other retried writes.