Skip to main content
Connect a client covers setup, OAuth or an API key, per client. This page covers what a credential can do once connected.

​
Scopes and repository access

Every tool requires one of three access levels. The levels are hierarchical: admin includes write, and write includes read. The Access column in the Tool reference shows the scope each tool needs. How far a credential reaches depends on how you signed in:
  • OAuth tokens are granted to your user within an organization and carry full access to that organization.
  • API keys can additionally be scoped to specific repositories. Tool calls targeting any other repository are rejected. This is the way to give an agent least-privilege access. See Authentication for key management.

​
Errors

A missing or invalid credential returns 401 Unauthorized with a WWW-Authenticate header pointing back at the metadata, so a client can re-discover and re-authenticate:
Error responses carry a stable code:
Server errors (5xx) additionally include error.trace_id — quote it when reporting an issue.