Authentication
Authenticate a client to Aroai
Use OAuth or a scoped Aroai API key, protect credentials and understand workspace access boundaries.
Choose OAuth when your client supports it
The endpoint advertises OAuth metadata. A compatible client can start sign-in after its initial unauthenticated request. Sign in with the Aroai account that has access to the intended workspace.
Use an API key for supported clients
Create an API key in the portal under API keys. The secret is shown once and starts with aroai_live_. Configure it in the client's protected credential store.
Authorization: Bearer aroai_live_YOUR_SECRET_KEYKeep the workspace boundary in view
- OAuth uses the workspace selected for the client binding; a user with multiple workspaces may need to select one.
- API keys carry scopes for tool access, resources and prompts.
- Workspace tool enablement and server status are checked when discovery and execution occur.
- A read-only workspace binding cannot execute mutating tools.
- Never paste a live secret into a public configuration, shared repository or screenshot.
Rotate a key carefully
Create and verify a replacement credential before removing the old one from dependent clients. Revoke a key that is lost or exposed, then review workspace activity and connected automations.
Local intelligence. Ready to build.
Start with a task you can inspect.
Connect a compatible client, choose a workflow and review the source fields that come back.