Skip to main content
Product API keys belong to a signed-in Darwin user. The key can act only within its configured scopes and the user’s current access to each agent.

​
Common scopes

A key cannot expand its own scopes. Create a new key when a workload needs a different boundary.

​
OAuth tokens from Connect

A Connect application uses an OAuth access token after a user completes Sign in with Darwin. The token identifies the application and user, while a live linked-agent grant controls the agents and scopes available now. Do not turn a Product API key into a shared Connect credential. If your product serves multiple customers, register a Connect application and use Sign in with Darwin.

​
Security

  • Keep API keys and refresh tokens out of browser storage, model prompts, logs, and source control.
  • Validate OAuth state and complete PKCE when using Connect.
  • Treat 401 as an invalid principal and 403 as a missing current scope or agent grant.
  • Use an Idempotency-Key for money movement and other retried writes.