> ## Documentation Index
> Fetch the complete documentation index at: https://docs.groundforge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> Choose user bearer authentication or a scoped service-account API key.

GroundForge accepts two public authentication patterns.

## User and CLI bearer token

Use an OIDC bearer token for user-driven administration:

```http theme={null}
Authorization: Bearer <access-token>
```

This is the same identity model used by the web application and `gforge login`.

## Service-account API key

Use a scoped API key for an external Agent or another runtime identity:

```http theme={null}
X-API-Key: <service-account-api-key>
```

Create a separate Service Account and credential for each integration. Limit it to the intended Organization, Workspace, Agent, or Gateway use.

## Provider callbacks

Twilio and Mailgun inbound callbacks do not use the bearer or API-key pattern. GroundForge verifies the provider signature with the credential stored on the Channel.

Never place bearer tokens, API keys, signing secrets, or model credentials in request content, screenshots, Trace metadata, or Git repositories.


## Related topics

- [REST API Overview](/api-reference/overview.md)
- [Weather MCP Example](/examples/weather-mcp.md)
- [MCP Providers](/platform/mcps.md)
- [Troubleshooting](/help/troubleshooting.md)