Authentication and workspace access
Understand account cookies, assistant OAuth grants and scoped API keys.
Website account
The website uses an HttpOnly session cookie. Browser mutations require an approved Origin and a session-bound CSRF token. Email sign-in uses a browser-bound, one-time code that expires in ten minutes. Requesting a new code invalidates the previous challenge. Codes are never placed in URLs.
Workspace membership controls what you can see. Owners and admins can authorize execution, create keys and manage category preferences.
Assistant OAuth
The connecting assistant uses an authorization code with S256 PKCE, a registered exact callback URL and the MCP resource parameter. You review the client and workspace before approving.
tools:read permits tool information and task results. tools:execute permits research that may spend workspace credits. Tokens are bound to the approved workspace. Revoke a grant under Connections to stop that assistant’s access.
API keys
Create a scoped key from Settings → API keys. Its secret is displayed once. Use the Authorization: Bearer header for supported MCP clients or REST calls. Do not put the key in a URL, public document, analytics event or browser storage.
Signing out revokes the website session; revoke assistant grants separately when needed. Keep access to your email inbox secure because it authorizes email-code sign-in.
Authorization: Bearer <your-workspace-key>