Adrata Developers
Use scoped workspace API keys or OAuth tokens with explicit route scopes and per-agent token identity.
Authorization: Bearer adrata_live_...
Adrata-Version: 2026-05-23
X-Request-ID: caller-generated-ulidKeys and OAuth tokens carry least-privilege scopes. Agent tokens include `agent_id` in introspection and audit logs so human users and non-human agents are not conflated.
Use workspace API keys for server-to-server integrations, OAuth for user-authorized applications, and agent tokens for non-human workflows that need separate audit identity.
SCIM and SAML are available for enterprise identity management. OAuth introspection and revocation endpoints let platforms verify and rotate credentials without creating support tickets.
Pin `Adrata-Version`, send `X-Request-ID`, scope credentials to the smallest route family, and rotate any key that appears in logs or client-side code.