Skip to main content
Fluent supports OAuth access tokens and API keys. Both represent a Fluent user, and access to agents, runs, documents, databases, and connections remains subject to that user’s permissions.

​
OAuth

OAuth is the preferred method when a person is present. The CLI uses Authorization Code with PKCE and requests these public API scopes: A token is granted only the scopes it asks for, so an integration can request read-only access and be unable to start a run or delete a document even though the same user could. Scopes are enforced per operation: a call that needs a scope the token lacks is rejected with 403, never silently downgraded. Which scope each operation requires is stated in the OpenAPI description under that operation’s security block, and in its page in the API reference. The scope vocabulary is also published, machine-readable, in the scopes_supported field of two discovery documents:
OAuth access is currently supported by the agent, run, and document operations. Other /api/v1 operations require an API key.

​
API keys

Use a dedicated, revocable API key for CI, backend services, and other unattended callers. Create API keys in your Fluent account and store them in a secret manager, never in source control. Send an API key in either supported header:
The CLI reads FLUENT_API_KEY or accepts --api-key. An explicit API key takes precedence over a saved OAuth session.

​
OAuth bearer tokens

Send a Fluent OAuth access token as a bearer credential:
OAuth tokens are audience-bound and scope-bound. A token issued for one agent’s MCP resource cannot be reused as a general API token.
Never place an API key or OAuth token in a URL, log line, repository, or client-side bundle.