---
title: "Authentication"
description: "Choose the credential accepted by each AgentMQ API surface."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

## Credential types

| Credential | Scope | Lifetime | Use |
| --- | --- | --- | --- |
| Clerk session | One signed-in person | Session-managed | Console and session-only routes |
| Personal access token | The issuing developer | 1–365 days | Management API except session-only routes |
| Agent key | One application | 1–90 days | `/v1/agent/**` operations |
| Private integration credential | One internal boundary | Configuration-defined | Webhooks and `/v1/internal/**` only |

Personal access tokens use the `amqp_` prefix. Agent keys use `amq_`. Both secrets are returned once; list endpoints return metadata only.

## Bearer requests

```http
Authorization: Bearer <credential>
```

An Agent key grants every currently enabled, supported operation for its application. The legacy `operationIds` field on key issuance is accepted for compatibility but ignored.

## Session-only routes

Developer tokens cannot call token management, invitation preview or acceptance, device approval, or Stripe top-up routes. These operations require the person to be interactively signed in.

## See also

- [Authentication matrix](/reference/authentication)
- [Applications and members](/build/applications)

Source: https://help.agent.mq/getting-started/authentication/index.mdx