> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.neetoauth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in with OAuth or connect with an API key, and understand what each one can reach.

The NeetoAuth MCP server accepts two credentials. They are not interchangeable: one acts as a person, the other acts as the workspace.

|            | OAuth                              | API key                          |
| ---------- | ---------------------------------- | -------------------------------- |
| Scope      | The person who approved it         | The whole workspace              |
| Identity   | A NeetoAuth user                   | None                             |
| Set up by  | Pasting the server URL             | Pasting a key into a config file |
| Revoked by | Signing out, or revoking the token | Deleting the key                 |

<Warning>
  An API key is not tied to a person, so the assistant is not limited by anyone's
  permissions. It can invite and deactivate members regardless of who is talking
  to it. Prefer OAuth unless you specifically need workspace-wide access.
</Warning>

## OAuth, scoped to you

An OAuth token resolves to a NeetoAuth user, so every tool call is checked against that person's permissions. A member who cannot invite people in the NeetoAuth UI cannot invite them through the assistant either, and listings are filtered to what they are allowed to see.

### Sign in

1. Add the server URL to your assistant. See [Connect](/mcp/connect).
2. The assistant opens NeetoAuth in your browser.
3. Enter the workspace you want to connect, on the **Connect your workspace** screen.
4. Sign in and approve the request.

The assistant stores the token and refreshes it on its own. You do not paste anything.

### What the server supports

|                         |                                                                |
| ----------------------- | -------------------------------------------------------------- |
| **Grant types**         | `authorization_code`, `refresh_token`                          |
| **PKCE**                | Required, `S256`                                               |
| **Scopes**              | `read`, `write`, `delete`, `offline_access`                    |
| **Client registration** | Dynamic, at `https://connect.neetoauth.com/mcp/oauth/register` |
| **Revocation**          | `https://connect.neetoauth.com/mcp/oauth/revoke`               |

Clients discover all of this automatically from `https://connect.neetoauth.com/.well-known/oauth-authorization-server`, so there is nothing to configure by hand.

Because registration is dynamic and accepts loopback redirect URIs, terminal clients such as Claude Code, Codex, and the Gemini CLI can complete the flow the same way a browser client does.

### Connecting more than one workspace

The consent screen asks which workspace to connect, so a token is granted for one workspace at a time. To reach a second workspace, add the server again under a different name and approve it for that workspace.

## API key, scoped to the workspace

An API key carries no user identity. The permission checks that apply to an OAuth session are skipped entirely, so the assistant can read and change anything in the workspace.

Use it when the assistant is acting as a service rather than as a person - a scheduled offboarding job, or a shared internal bot - and when you accept that it is not bounded by any individual's permissions.

### Get a key

Create one in your NeetoAuth workspace, then pass it as a bearer token:

```
Authorization: Bearer YOUR_API_KEY
```

See [API authentication](/getting-started/authentication) for where keys live and how to rotate them.

<Warning>
  Treat the key like a password. Anything holding it can invite or deactivate
  members. Do not commit it - `.vscode/mcp.json` in particular lives in your
  repository. Prefer an environment variable where your client supports one.
</Warning>

## How it compares to the API and CLI

|                   | REST API             | CLI                   | MCP                                           |
| ----------------- | -------------------- | --------------------- | --------------------------------------------- |
| Credential        | API key              | Browser sign-in       | OAuth or API key                              |
| Acts as           | The workspace        | The person signed in  | The person (OAuth) or the workspace (API key) |
| Permission checks | Not applied          | Applied               | Applied with OAuth, skipped with an API key   |
| Best for          | Backend integrations | Scripts and terminals | AI assistants                                 |