> ## Documentation Index
> Fetch the complete documentation index at: https://www.fluenterp.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Choose OAuth for people and API keys for unattended workloads.

Fluent supports OAuth access tokens and API keys. Both represent a Fluent user, and access to agents, runs, documents, databases, and connections remains subject to that user's permissions.

## OAuth

OAuth is the preferred method when a person is present. The CLI uses Authorization Code with PKCE and requests these public API scopes:

| Scope         | Access                                                             |
| ------------- | ------------------------------------------------------------------ |
| `agents:read` | List accessible agents                                             |
| `runs:read`   | Read runs and documents                                            |
| `runs:write`  | Upload files, create runs, process documents, and delete documents |

A token is granted only the scopes it asks for, so an integration can request read-only access and be unable to start a run or delete a document even though the same user could. Scopes are enforced per operation: a call that needs a scope the token lacks is rejected with `403`, never silently downgraded.

Which scope each operation requires is stated in the [OpenAPI description](/docs/api-reference/openapi.yaml) under that operation's `security` block, and in its page in the API reference. The scope vocabulary is also published, machine-readable, in the `scopes_supported` field of two discovery documents:

```text theme={null}
https://www.fluenterp.com/.well-known/oauth-authorization-server
https://www.fluenterp.com/api/v1
```

OAuth access is currently supported by the agent, run, and document operations. Other `/api/v1` operations require an API key.

## API keys

Use a dedicated, revocable API key for CI, backend services, and other unattended callers. Create API keys in your Fluent account and store them in a secret manager, never in source control.

Send an API key in either supported header:

```http theme={null}
Authorization: Bearer fl-...
```

```http theme={null}
X-API-Key: fl-...
```

The CLI reads `FLUENT_API_KEY` or accepts `--api-key`. An explicit API key takes precedence over a saved OAuth session.

## OAuth bearer tokens

Send a Fluent OAuth access token as a bearer credential:

```http theme={null}
Authorization: Bearer flpt_...
```

OAuth tokens are audience-bound and scope-bound. A token issued for one agent's MCP resource cannot be reused as a general API token.

<Warning>
  Never place an API key or OAuth token in a URL, log line, repository, or
  client-side bundle.
</Warning>