NQD API authentication

Business requests use Authorization: Bearer <access_token>. NQD verifies the credential and resolves membership on every request. Invalid or expired credentials return 401. Cookies never select API identity or workspace scope.

POST /v1/email/challenges and POST /v1/email/verifications accept bounded JSON and do not use Workspace-Id. Verification returns an access token, bearer type, and expiration. It does not set a persistent session cookie.

Browser sign-in uses Auth’s /signin, /signup, and /verify, then hands off to Dash. Auth and Dash share the browser session cookie across their configured parent domain. These flows are not developer REST endpoints.

Create API keys in Dash under Settings → Integrations → API keys or with the workspace-scoped API key endpoints. The secret appears once. Store it securely.

Use OAuth when an interactive client needs delegated workspace access. NQD uses an authorization-code flow with S256 PKCE. The issuer binds each grant to the client, exact redirect URI, requested resource origin, workspace, and scopes. The authorization endpoints are on the configured Auth origin:

/.well-known/oauth-authorization-server
/.well-known/oauth-protected-resource
/oauth/register
/oauth/authorize
/oauth/token
/oauth/revoke

The CLI uses a loopback callback and stores tokens in the native OS credential manager. The token response includes the consented workspace_id. Remote MCP clients discover the issuer from protected-resource metadata and send the resulting resource-bound access token in Authorization: Bearer. The API and MCP reject a token issued for another resource. Core checks the active grant, workspace membership, token expiry, and operation scope on every request.

OAuth grants are workspace-bound. Workspace operations require the selected workspace. account.context is the sole subject read and is filtered to that workspace; global profile and workspace mutations are denied through the grant.

The shared scope vocabulary currently contains read and write. Clients request only the scopes they need, and the consent screen and resource server enforce the same values.

Refresh tokens rotate. Reuse of a rotated refresh token revokes its token family. Revoking a grant or removing workspace membership takes effect on the next guarded operation. Never put credentials in URLs or resource bodies.

See the challenge endpoint and verification endpoint in the generated authentication reference.