# Authentication

## REST API keys

Create keys in **Settings → Developers**. Each key:

- Belongs to one organisation
- Inherits the creating user's role
- Is further limited by the abilities you tick
- Is sent as `Authorization: Bearer dop_…`

```bash
curl -H "Authorization: Bearer dop_…" \
  -H "Accept: application/json" \
  https://your-org.doorops.com/api/v1/ping
```

There are no deletes on the public API. Rotate a key by creating a new one and revoking the old.

`api_access` is a Growth entitlement. Lite cannot mint keys.

## MCP OAuth

Tenant MCP uses OAuth 2.1 (Passport). The only MCP scope is `mcp:use`. The agent signs in as a DoorOps user and keeps that user's role. Revoke under **Settings → Connected apps**.

Do not put API keys into an MCP client. Use OAuth.

## Third-party OAuth apps

Register at `/developer/apps`. Allowed scopes are the REST family (`customers:read`, `jobs:write`, …). `mcp:use` is not offered there.