Send Authorization: Bearer <YOUR_API_KEY> over HTTPS. A machine key is bound to its tenant; do not attach human workspace selectors to machine requests. Keep keys in server-side secret storage or an MCP client's private credential settings. Never place keys in query strings, prompts, shared configuration or logs.
Keys are subject to current scopes, workspace policy, hierarchy, expiry and revocation. Delegated key lifetimes cannot exceed their issuer's lifetime. Revoking a key disables its delegated descendants. Rotation overlap defaults to zero.
REST key issue/rotation returns the new secret once. An idempotent replay may show completion with secretAvailable: false; inspect metadata and rotate if a usable secret is still needed. MCP never returns the raw key secret: when configured, authorized key-management tools return a short-lived human claim link.
Initial API enablement and access-control changes require a verified human administrator. Human sessions can select a permitted workspace using X-Engage-Meta-Organization and X-Engage-Organization; the server verifies the selection against persisted authority. Machine and OAuth principals cannot use these selectors to switch tenants.
For OAuth-capable MCP clients, follow the hosted endpoint's protected-resource and authorization-server discovery metadata. Tenant API enablement alone does not grant OAuth access or additional scopes. See MCP setup for connection guidance and API scope and availability for workflow boundaries.