> ## Documentation Index
> Fetch the complete documentation index at: https://docs.risos.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate REST and MCP requests with scoped Workspace API keys.

RISOS REST and product MCP use revocable, Workspace-scoped bearer keys.

```http theme={null}
Authorization: Bearer risos_sk_…
```

Create keys from **RISOS → Developers**. The full secret is shown once; RISOS stores only its hash.

## Scopes

| Scope            | Allows                                                                                                      |
| ---------------- | ----------------------------------------------------------------------------------------------------------- |
| `research:read`  | Products, Projects, ResearchJobs, Deliverables, Ask, Explore, Signals, Intelligence, Opportunities, Reports |
| `research:write` | Create/update Projects, start/refresh/cancel Research, create Reports                                       |
| `evidence:read`  | Evidence and Entities                                                                                       |
| `monitor:read`   | Read Monitors                                                                                               |
| `monitor:write`  | Create or update Monitors                                                                                   |
| `mcp:use`        | Connect to the product MCP endpoint; MCP tools still require their capability scopes                        |

Use the minimum scopes needed by each integration and use separate keys for separate clients or environments.

## Authentication failures

* `401`: the credential is missing, invalid, expired, or revoked.
* `403`: the credential is valid but lacks the required scope.

Do not retry either response unchanged.

RISOS MCP currently supports API-key authentication for clients that can send a custom `Authorization` header. OAuth 2.1 is not advertised as available until the complete production authorization profile is configured and verified.