Auth, keys & scopes

Purpose

Every toolkit surface authenticates with the same Authorization: Bearer header — an API key or an OAuth token. What differs is the key's type (who it can act as) and its scopes (what it may call). Getting these right is the difference between a safely-bounded agent and a 403 loop.

When to use / when NOT to use

• Use when provisioning an agent's credential, debugging 401/403, or acting across teams/orgs.
• For interactive personal use, reply auth login (OAuth) is simpler — see reply-cli.

Prerequisites

Access to Reply → Settings → API Key (personal), or owner/admin rights for Team/Org keys.

Execution guidance