> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Public API requests with nOps API keys

# Authentication

All `/v1` requests require an nOps API key in the `Authorization` header:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer <api_key>
```

## Creating keys

1. Sign in to nOps as an organization admin on **Inform + Operate**.
2. Open **Settings → Security → API Keys**.
3. Create a key and assign the permissions your integration needs.
4. Copy the key when shown — it is only displayed once.

## Security rules

* Keys are **never** accepted in query parameters.
* Session cookies are **not** used on `/v1` — header-only auth.
* Keys are scoped to your nOps organization and cannot be used across tenants.

## Scopes

| Scope                                                            | Access                                                                |
| ---------------------------------------------------------------- | --------------------------------------------------------------------- |
| `cost:read`                                                      | Explorer / cost queries                                               |
| `reports:read` / `reports:write`                                 | Saved reports                                                         |
| `budgets:read` / `budgets:write`                                 | Budgets and alerts                                                    |
| `recommendations:read`                                           | Recommendations list                                                  |
| `anomalies:read`                                                 | Cost anomalies                                                        |
| `feed:read`                                                      | Feed runs                                                             |
| `scheduled-prompts:read` / `scheduled-prompts:write`             | Scheduled prompts                                                     |
| `notifications:read` / `notifications:write`                     | Notification schedules                                                |
| `commitments:read`                                               | Commitments (reserved; endpoint returns `501` until released)         |
| `cost-allocation:read` / `cost-allocation:write`                 | Cost Allocation showbacks, rules, and spend analytics                 |
| `explorer-dashboards:read` / `explorer-dashboards:write`         | Explorer dashboards                                                   |
| `ai-optimization:read` / `ai-optimization:write`                 | AI Optimization default dashboard and anomalies                       |
| `map-manager:read` / `map-manager:write`                         | MAP Manager projects, resources, and accounts                         |
| `business-unit-economics:read` / `business-unit-economics:write` | Business Unit Economics models, units, items, and reports             |
| `contract-tracker:read` / `contract-tracker:write`               | Contract Tracker contracts and burndown                               |
| `mcp:read`                                                       | MCP read access (Clara agent / internal-envelope surface)             |
| `mcp:write`                                                      | MCP write access — requires `mcp:read` as well for mutating endpoints |

When creating an API key, assign the permissions your integration needs in **Settings → Security → API Keys**. `mcp:read` and `mcp:write` gate the Clara MCP agent surface; they do not authorize API-key `/v1` calls — use the granular scopes above for programmatic API access.