Skip to main content
AgentRuntime supports multiple authentication methods depending on whether you use the Console, call the REST API, or connect an IDE through Platform MCP.

​
Console session (browser)

Sign in at console.agentruntime.io with:
  • Email and password — Requires email verification for new accounts
  • Google OAuth — Sign in with Google or Google One Tap
The BFF issues a session cookie scoped to .agentruntime.io. The Console refreshes tokens automatically. Password reset and change-password flows are at /auth/forgot-password and account settings.

​
Personal access tokens (PATs)

PATs are the recommended method for scripts, CI pipelines, and Platform MCP.
1

Create a token

In the Console, go to Settings → API keys (/settings?tab=apiKeys). Click Create API key and give the token a descriptive name.
2

Select scopes

Choose the minimum scopes needed:
3

Copy the token

The token value is shown once. Store it in a secrets manager.
4

Call the API

Send Authorization: Bearer YOUR_PAT on every request, plus X-Tenant-Id and X-Project-Id for scoped operations.
PATs are validated against your user identity and project role. A PAT with workflow:run still requires project_contributor on the target project.

​
Console Bearer JWT (mobile and IDE clients)

Native clients (mobile app, VS Code workbench) sign in with Keycloak OAuth and send the access token as:
The BFF resolves the user from the JWT via Wheelhouse token-session. X-Tenant-Id overrides the default workspace so one login can act in different tenants (for example, separate VS Code windows). Membership is validated on every request. When X-Tenant-Id is omitted, the BFF falls back to the user’s default workspace (same behavior as mobile). If no workspace can be resolved, protected routes return 400 X-Tenant-Id required (except /v1/me during onboarding). Platform MCP forwards X-Tenant-Id and X-Project-Id from the MCP HTTP request to the BFF when present.

​
Platform MCP

Connect Cursor or other MCP clients to:
Authenticate with the same PAT used for REST. Platform MCP tools wrap BFF operations — list workflows, trigger runs, manage resources — without crafting raw HTTP.

​
Google OAuth (API)

Google OAuth for user login uses /v1/auth/oauth/google/*. This is separate from Google connections for Workspace MCP adapters (/v1/connections/google/*).

​
Inbound webhook signatures

External systems triggering runs via inbound webhooks authenticate with HMAC signatures on the subscription secret — not PATs.

​
Security practices

  • Rotate PATs on a schedule and revoke unused tokens
  • Use the narrowest scopes that satisfy your automation
  • Never commit tokens to git or embed them in client-side code
  • Tenant admins can enforce domain verification and auth policy for workspace members
If a PAT is exposed, revoke it immediately in the Console and create a new one. Audit recent runs and API activity for unauthorized use.