Authentication - RISOS Developer Docs

RISOS REST and product MCP use revocable, Workspace-scoped bearer keys.

Authorization: Bearer risos_sk_…

Create keys from RISOS → Developers. The full secret is shown once; RISOS stores only its hash.

Scopes

Scope	Allows
`research:read`	Products, Projects, ResearchJobs, Deliverables, Ask, Explore, Signals, Intelligence, Opportunities, Reports
`research:write`	Create/update Projects, start/refresh/cancel Research, create Reports
`evidence:read`	Evidence and Entities
`monitor:read`	Read Monitors
`monitor:write`	Create or update Monitors
`mcp:use`	Connect to the product MCP endpoint; MCP tools still require their capability scopes

Use the minimum scopes needed by each integration and use separate keys for separate clients or environments.

Authentication failures

401: the credential is missing, invalid, expired, or revoked.
403: the credential is valid but lacks the required scope.

Do not retry either response unchanged. RISOS MCP currently supports API-key authentication for clients that can send a custom Authorization header. OAuth 2.1 is not advertised as available until the complete production authorization profile is configured and verified.