---
title: "Authentication and scopes"
description: "Authenticate AI Glot API requests with workspace keys or OAuth tokens, choose minimum scopes and rotate credentials without exposing secrets."
canonical: "https://ai-glot.com/docs/api/authentication"
updated: "2026-08-09"
---

# Authentication and scopes

Send a workspace API key or OAuth access token as a bearer credential:

```http title="Authorization header"
Authorization: Bearer aig_live_••••••••
```

Never place a credential in a query string. URLs are copied into logs, browser history and referrer headers.

## Workspace API keys

An admin creates keys in [Settings → API](https://app.ai-glot.com/settings/api). The complete secret is shown once; AI Glot stores only a protected hash. Up to 10 keys may be active in a workspace.

![Create an API key dialog](/docs/screenshots/platform/api-key-create.webp)

_Create a named key and choose its scopes_

Use a separate named key for each integration. Rotate by creating the replacement, updating the integration, confirming the old key is quiet, then revoking it.

## OAuth tokens

The CLI and compatible MCP clients can use OAuth 2.1. OAuth is recommended for a person because the connection records who approved it and respects that member's access ceiling. API keys remain the right fit for CI and backend services.

## Launch scopes

| Scope              | Allows                                                             |
| ------------------ | ------------------------------------------------------------------ |
| `account:read`     | Workspace identity, plan, capabilities, limits and credit summary  |
| `usage:read`       | Usage totals and time buckets                                      |
| `batches:read`     | List translations, inspect progress and download completed results |
| `batches:write`    | Rename, archive or restore translations                            |
| `glossaries:read`  | List and retrieve glossaries                                       |
| `glossaries:write` | Create, update, replace or delete glossaries                       |

A missing scope returns `403 insufficient_scope`. Future scope names may already exist internally, but they do not imply that upload, batch creation or webhooks are available in v1.

## Member ceiling

Workspace admins can limit developer access for members. An OAuth client receives the intersection of what it requested and what the approving member may use. Reconnecting with a broader request cannot bypass a read-only ceiling.

> **Danger**
>
> Treat a workspace API key like a password. Do not commit it, paste it into client-side JavaScript, include it in screenshots, or send it to an AI model as ordinary prompt text.