> For the complete documentation index, see [llms.txt](https://docs.meetalto.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.meetalto.ai/api/authentication.md).

# Authentication and permissions

Choose a credential, restrict its permissions and keep workspace access clear.

Send a valid Meet Alto credential with every API request:

```http
Authorization: Bearer YOUR_CREDENTIAL
```

## Choose the connection type

| Use case                  | Connection                                                            |
| ------------------------- | --------------------------------------------------------------------- |
| Your own server or script | A workspace-bound API key, when available in Settings → Integrations. |
| An interactive AI app     | OAuth sign-in through the [MCP setup flow](/mcp/quickstart.md).       |

Customers do not need to create a separate authentication-provider account or register their own OAuth application to use the standard MCP setup flow.

## Choose the smallest useful permission set

Each endpoint lists required permissions, also called scopes. `workspace:read`, for example, allows the workspace read operation. Some operations need additional permissions depending on the input or the resource's saved state. For example, saving an already active agent requires publishing access as well as writing access.

Permissions are only one part of access. Your current role, membership, plan, resource ownership and provider restrictions still apply. An API key cannot grant owner access to a team member who does not have that role.

## Keep workspace boundaries clear

A credential is bound to the workspace chosen when it was created or authorized. Create separate connections for different workspaces and name them clearly. Supplying another workspace's resource ID does not grant access to it.

## Change or remove access

Manage API keys under **Settings → Integrations → Manage API keys**. If a key no longer has the permissions your integration needs, create a replacement with the appropriate access, update your integration and revoke the old key when it is no longer needed.

For OAuth connections, [manage your assistant's access](/mcp/permissions.md). Removing a local entry in an AI app is not proof that the server-side authorization was revoked.

If you lose workspace membership or a required role, existing credentials do not preserve the old access.