Authentication
User-owned keys with limited permissions.
Every request sends Authorization: Bearer adl_live_…. Clerk sessions are used by the webapp and MCP; the public API accepts API keys only.
A key belongs to a user and their tenant. It can access only resources that user is authorized to use. Scopes further restrict access: domain:read, domain:write, and domain:destroy. write includes read; destroy is granted separately. *:read allows read operations within the user's existing permissions.
destroy covers irreversible actions such as deleting resources and revoking access. A missing scope returns 403 insufficient_scope with required_scope and WWW-Authenticate.
Keys can only be created and rotated in the webapp. After rotation, the previous key remains valid for up to 24 hours; any earlier expiration still applies. Revocation takes effect immediately. Existing keys can only have their scopes narrowed.
Store keys in environment variables or a secret store. Use them exclusively on the server. The reference can save an entered key in your browser; use this convenience only on a trusted device and remove the key from the authentication panel afterward.