# Authenticate a client to Aroai

Use OAuth or a scoped Aroai API key, protect credentials and understand workspace access boundaries.

Canonical: https://aroai.com/docs/authentication/

## Choose OAuth when your client supports it

The endpoint advertises OAuth metadata. A compatible client can start sign-in after its initial unauthenticated request. Sign in with the Aroai account that has access to the intended workspace.

## Use an API key for supported clients

Create an API key in the portal under API keys. The secret is shown once and starts with aroai_live_. Configure it in the client's protected credential store.

```text
Authorization: Bearer aroai_live_YOUR_SECRET_KEY
```

## Keep the workspace boundary in view

- OAuth uses the workspace selected for the client binding; a user with multiple workspaces may need to select one.
- API keys carry scopes for tool access, resources and prompts.
- Workspace tool enablement and server status are checked when discovery and execution occur.
- A read-only workspace binding cannot execute mutating tools.
- Never paste a live secret into a public configuration, shared repository or screenshot.

## Rotate a key carefully

Create and verify a replacement credential before removing the old one from dependent clients. Revoke a key that is lost or exposed, then review workspace activity and connected automations.