---
title: Authentication
description: OAuth sessions and machine credentials.
canonical: https://breezewish.com/developers/agents/authentication
raw: https://breezewish.com/developers/agents/authentication.md
apiVersion: v1
lastUpdated: 2026-10-18
category: Agents
---

# Authentication

Send `Authorization: Bearer` on protected REST and MCP calls.

## Methods

- A human session from the BreezeWish login flow.
- An organization-owned machine credential minted in API keys.

Tokens expire. Rotate a credential by minting a new key and revoking the old one. Revocation takes effect on the next request. The audience is the BreezeWish API and MCP resource. A token for another resource is rejected.

Do not put secrets in an Agent Card, a webhook URL, source control, or these docs.

## Errors

UNAUTHENTICATED, INVALID_CREDENTIAL.

## Local development only

Point your client at the API origin and MCP URL from your environment. Do not copy those local origins into production configuration.