> ## Documentation Index
> Fetch the complete documentation index at: https://docs.darwin.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Product API authentication

> Authenticate owner-controlled clients with scoped Darwin API keys.

Product API keys belong to a signed-in Darwin user. The key can act only within its configured scopes and the user's current access to each agent.

```http theme={null}
Authorization: Bearer darwin_...
```

## Common scopes

| Capability                                   | Scopes                                                       |
| -------------------------------------------- | ------------------------------------------------------------ |
| Read and manage agents                       | `agents:read`, `agents:write`                                |
| Create and manage goals                      | `goals:read`, `goals:write`                                  |
| Read and answer requests                     | `requests:read`, `requests:write`                            |
| Use conversations                            | `conversations:read`, `conversations:write`                  |
| Inspect, install, and configure agent skills | `agents:read`, `agents:write`                                |
| Inspect and authorize integrations           | `integrations:read`, `connections:read`, `connections:write` |
| Read or change wallet controls               | `payments:read`, `payments:write`                            |

A key cannot expand its own scopes. Create a new key when a workload needs a different boundary.

## OAuth tokens from Connect

A Connect application uses an OAuth access token after a user completes Sign in with Darwin. The token identifies the application and user, while a live linked-agent grant controls the agents and scopes available now.

Do not turn a Product API key into a shared Connect credential. If your product serves multiple customers, register a Connect application and use [Sign in with Darwin](/connect/sign-in-with-darwin).

## Security

* Keep API keys and refresh tokens out of browser storage, model prompts, logs, and source control.
* Validate OAuth state and complete PKCE when using Connect.
* Treat `401` as an invalid principal and `403` as a missing current scope or agent grant.
* Use an `Idempotency-Key` for money movement and other retried writes.