Skip to main content
Choose AI agent authentication based on who owns the account and whether a human can approve access.

​
Agent signup

The CLI solves enrollment proof of work and saves the delivered key privately. Keep the enrollment state for recovery. See Sign up from an agent.

​
Key-based access

Set BEAD_API_KEY through your secret manager or select a private BEAD_API_KEY_FILE. To import a key from a secret-producing process, pipe it to bead login --key-stdin. The CLI verifies it against /v1/limits and writes it to a fresh private credential file. Never put keys in URLs or commit them to source control. Headless MCP clients send a bearer credential on every request to https://api.bead.run/mcp.

​
Device login

A human opens the returned link, signs in with GitHub, and approves access. The CLI polls authorization and saves the token. Restart login if the device request expires or is rejected. Device login grants read write access for one hour without admin scope; use the dashboard or an admin-scoped API key for ownership, membership, key creation, or billing administration. To renew expired access, select a fresh private BEAD_API_KEY_FILE and run bead login again; login does not overwrite an existing file.

​
Delegated MCP OAuth

Interactive clients follow the 401 response’s resource_metadata discovery URL. The authorization server supports dynamic public-client registration, authorization code flow, and S256 PKCE. Redirect URIs must match registered values exactly. Consent uses GitHub sign-in and permission approval. Tokens last one hour and remain bounded by the underlying credential’s organization, scopes, expiry, revocation, and budget. Reconnect when the token expires. Read MCP authentication and Protect credentials.