Authentication

API keys, OAuth 2.1 connected apps, agent credentials and scopes.

Authenticate with OAuth 2.1 or an API key
Get a token as a connected app (OAuth 2.1 with PKCE), as an AI teammate (client credentials) or as an integration (API key), and send it on every call.
Choose between an API key, a connected app and an AI teammate
Three ways into one API: an API key for your own software, an OAuth connected app for a product other people use, and an AI teammate for AI that works on its own. Which to pick and why.
Rate limits, daily caps and other limits on a credential
The per-minute limits, the optional daily cap on changes, working hours, address allowlists, expiry and branch limits that can apply to an API key, connected app or AI teammate.
Scopes reference
Every scope a key, connected app or agent can hold, what each one allows, and the rules that keep a scope from ever granting more than the person or role behind it.