Credential types
| Credential | Scope | Lifetime | Use |
|---|---|---|---|
| Clerk session | One signed-in person | Session-managed | Console and session-only routes |
| Personal access token | The issuing developer | 1–365 days | Management API except session-only routes |
| Agent key | One application | 1–90 days | /v1/agent/** operations |
| Private integration credential | One internal boundary | Configuration-defined | Webhooks and /v1/internal/** only |
Personal access tokens use the amqp_ prefix. Agent keys use amq_. Both secrets are returned once; list endpoints return metadata only.
Bearer requests
Authorization: Bearer <credential>An Agent key grants every currently enabled, supported operation for its application. The legacy operationIds field on key issuance is accepted for compatibility but ignored.
Session-only routes
Developer tokens cannot call token management, invitation preview or acceptance, device approval, or Stripe top-up routes. These operations require the person to be interactively signed in.
Treat every key as a secret. Keep credentials server-side, and never place them in browser code, prompts, URLs, logs, or source control. Revoke or rotate a key as soon as it may have been exposed.