> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bead.run/llms.txt
> Use this file to discover all available pages before exploring further.

# AI agent authentication

> Choose AI agent authentication through signup, API keys, device login, or delegated MCP OAuth.

Choose AI agent authentication based on who owns the account and whether a human can approve access.

| Method | Use it for |
| - | - |
| `bead signup` | An agent creating its own organization and trial. |
| Existing API key | Headless services, CI, and MCP clients. |
| `bead login` | A human authorizing CLI access through a device code. |
| MCP OAuth | Interactive clients that support delegated browser authorization. |

## Agent signup

```bash theme={null}
bead signup
```

The CLI solves enrollment proof of work and saves the delivered key privately. Keep the enrollment state for recovery. See [Sign up from an agent](https://docs.bead.run/agent-signup.md).

## Key-based access

Set `BEAD_API_KEY` through your secret manager or select a private `BEAD_API_KEY_FILE`. To import a key from a secret-producing process, pipe it to `bead login --key-stdin`. The CLI verifies it against `/v1/limits` and writes it to a fresh private credential file.

Never put keys in URLs or commit them to source control. Headless MCP clients send a bearer credential on every request to `https://api.bead.run/mcp`.

## Device login

```bash theme={null}
bead login
```

A human opens the returned link, signs in with GitHub, and approves access. The CLI polls authorization and saves the token. Restart login if the device request expires or is rejected.

Device login grants `read write` access for one hour without admin scope; use the dashboard or an admin-scoped API key for ownership, membership, key creation, or billing administration. To renew expired access, select a fresh private `BEAD_API_KEY_FILE` and run `bead login` again; login does not overwrite an existing file.

## Delegated MCP OAuth

Interactive clients follow the 401 response's `resource_metadata` discovery URL. The authorization server supports dynamic public-client registration, authorization code flow, and S256 PKCE. Redirect URIs must match registered values exactly.

Consent uses GitHub sign-in and permission approval. Tokens last one hour and remain bounded by the underlying credential's organization, scopes, expiry, revocation, and budget. Reconnect when the token expires.

Read [MCP authentication](https://docs.bead.run/mcp/connect.md) and [Protect credentials](https://docs.bead.run/security/credentials.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.