Skip to main content
Use sandbox API authentication with a private bead key in the X-API-Key header for direct API requests. The SDKs read BEAD_API_KEY by default.

​
API keys

Load the key through a private environment or secret manager. Keep it out of URLs, source files and request logs. See agent signup for enrollment and CLI accounts for CI preset key creation.

​
Delegated bearer access

The API also accepts supported delegated OAuth credentials in Authorization: Bearer. Tokens are audience-bound. API device authorization through bead login targets the API audience; MCP OAuth targets the canonical MCP resource. Use the token issued for the service you are calling. Delegation retains the original credential identity. Organization restrictions, scope, revocation and prepaid budget checks still apply. Follow the client’s authorization flow and reconnect when credentials expire. A scoped bead key can be used as bearer authentication on MCP. For direct API-key requests, use X-API-Key.

​
Scope and resource access

The server enforces read, use, write and admin authority according to the route. Reads generally require read access; execution and existing-machine mutations require use authority; creation requires write authority. Account administration, billing settings and other administrative controls require admin authority. A CI preset key has additional resource restrictions: it can create machines and access or delete its own machines, but cannot access other machines, credential profiles or billing administration. A valid key does not bypass funding or admission checks.

​
Public prices

Pricing and estimates do not require credentials:
GET /v1/pricing is the live price source. Read workload estimates before provisioning. An authentication failure returns 401; insufficient authority returns 403. Inspect the response before retrying or changing credentials.