Authentication

Send Authorization: Bearer on protected REST and MCP calls.

Methods

• A human session from the BreezeWish login flow.
• An organization-owned machine credential minted in API keys.

Tokens expire. Rotate a credential by minting a new key and revoking the old one. Revocation takes effect on the next request. The audience is the BreezeWish API and MCP resource. A token for another resource is rejected.

Do not put secrets in an Agent Card, a webhook URL, source control, or these docs.

Errors

UNAUTHENTICATED, INVALID_CREDENTIAL.

Local development only

Point your client at the API origin and MCP URL from your environment. Do not copy those local origins into production configuration.