# Flow Authentication

Flow API and MCP access require a provisioned workspace. Use workspace-issued bearer credentials or enterprise OAuth client credentials.

## Bearer Tokens

Send credentials as:

```
Authorization: Bearer <token>
```

Workspace API keys are scoped to one team. Team isolation is enforced on every v2 route; a token for one team cannot inspect or mutate another team.

## Scopes

- `runs:read`
- `runs:write`
- `queues:write`
- `approvals:write`
- `files:read`
- `sandboxes:write`
- `webhooks:manage`
- `mcp:call`

Rotate credentials on owner changes, integration scope changes, suspected exposure, or automation handoff. Use team-owned credentials for shared automation and user-owned credentials for personal connections.