> ## Documentation Index > Fetch the complete documentation index at: https://redbark.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > Authenticate with the Redbark Advisor API using a firm API key or an OAuth access token, and choose the scopes each one gets. Every call sends a bearer token in the `Authorization` header: ``` Authorization: Bearer ``` There are two kinds of token: * An **API key** acts as the admin who made it. Use it for your own scripts and integrations. * An **OAuth access token** acts as the member who connected the app. Use it for an app that each person connects as themselves. Both carry scopes. Both share the same rate limit of 120 requests a minute. ## API keys ### Make a key 1. Open **Settings > API and MCP**. 2. Under **API keys**, select **New key**. 3. Give the key a name. 4. Choose its access: **All**, **Read only** or **Restricted**. Restricted lets you pick read or write for each area. 5. Select **Create key** and copy it. > [!WARNING] > > We show a key once, when you make it. Store it somewhere safe. If you lose it, revoke it and make another. * Keys start with `rbk_org_live_`. * Only admins can make or revoke keys. Every member can see the list of keys. * A firm can have 25 active keys. * The list shows each key's name, access, who made it and when it was last used. ### Who a key acts as A key acts as the admin who made it. Changes it makes are recorded against that admin. A key can make admin-only calls. If the admin who made a key leaves the firm, the key stops working. Calls fail with `403 member_removed`. Make a new key from an admin who is still in the firm. ### Revoke a key Select **Revoke** next to the key in **Settings > API and MCP**. Anything using the key stops working straight away. This cannot be undone. ## OAuth for apps An app can ask a member to connect it to their firm. The app then acts as that member, with that member's role. If the member is not an admin, the app cannot make admin-only calls. Advisor is a standard OAuth 2.1 authorization server: * Authorization code flow with PKCE (`S256` only). * Public clients only, with no client secret. * Dynamic client registration. ### Discovery | Endpoint | What it is | | - | - | | `GET /.well-known/oauth-authorization-server` | Authorization server metadata (RFC 8414) | | `GET /.well-known/oauth-protected-resource/api/v1` | Metadata for the REST API (RFC 9728) | | `POST /oauth/register` | Dynamic client registration (RFC 7591) | | `GET /oauth/authorize` | The consent page the member sees | | `POST /oauth/token` | Exchanges a code or a refresh token | | `POST /oauth/revoke` | Ends a token or a connection (RFC 7009) | All paths are on `https://advisor.redbark.com`. ### The flow 1. Register your app at `/oauth/register` with its name and redirect addresses. 2. Send the member to `/oauth/authorize` with `client_id`, `redirect_uri`, `response_type=code`, `code_challenge`, `code_challenge_method=S256` and `resource=https://advisor.redbark.com/api/v1`. Add `scope` to suggest the scopes you want. 3. The member signs in, picks the firm and chooses the access the app gets. 4. Exchange the returned code at `/oauth/token`. 5. Call the API with the access token. Refresh it with the refresh token when it expires. > [!NOTE] > > Ask for the `resource` `https://advisor.redbark.com/api/v1`. A token is bound to one API. A request that names no resource gets a token for the MCP server, which the REST API refuses. ### Tokens | Token | Prefix | Lasts | | - | - | - | | Authorization code | `rbk_adv_code_` | 10 minutes, used once | | Access token | `rbk_adv_at_` | 1 hour | | Refresh token | `rbk_adv_rt_` | 90 days, replaced on every use | * Using a code or a refresh token twice ends the connection. * The member's role is checked on every request. A role change takes effect on the next call. * A member who is removed from the firm loses access straight away. ### Redirect addresses * `http://localhost`, `http://127.0.0.1` and `http://[::1]` are accepted for apps on the same machine, on any port. * A hosted `https` address must be on a host we have approved. Contact support to have your app added. * Up to 10 addresses per app. ### Ending a connection A member can disconnect their own apps under **Connected apps** in **Settings > API and MCP**. An admin can disconnect anyone's. The app stops working straight away. An app can also end its own connection by sending its refresh token to `/oauth/revoke`. ## Scopes A scope is an area and a level: `:read` or `:write`. A write scope includes its read scope. | Area | Read scope | Write scope | Covers | | - | - | - | - | | Firm | `organisation:read` | `organisation:write` | The firm, its name and its branding | | Team | `members:read` | `members:write` | Team members and their roles | | Clients | `clients:read` | `clients:write` | Clients, their people and portal invites | | Checklists | `checklists:read` | `checklists:write` | Checklist templates, the checklists sent to clients and their answers | | Documents | `documents:read` | `documents:write` | Documents clients upload and the details read from them | | Money | `money:read` | `money:write` | Bank connections, accounts, balances and transactions | | Document types | `document_types:read` | `document_types:write` | Document types, their fields and the client facts they fill | | Messages | `messages:read` | `messages:write` | Messages between the firm and clients | | Reports | `reports:read` | `reports:write` | Reports exported for clients | | Webhooks | `webhooks:read` | `webhooks:write` | Webhook endpoints and their deliveries | * **All** gives every read and write scope. * **Read only** gives every read scope and no write scope. * A call without the scope it needs fails with `403 insufficient_scope`. The message names the scope. Scopes and roles are separate checks. A call needs the scope, and an admin-only call also needs an admin. See [admin-only calls](https://redbark.com/docs/advisor/api-reference/overview.md#admin-only-calls). ## Failed authentication | Status | Code | Meaning | | - | - | - | | 401 | `missing_api_key` | No bearer token was sent | | 401 | `invalid_api_key` | The API key is wrong or revoked | | 401 | `invalid_access_token` | The access token is wrong or was issued for a different API | | 401 | `expired_access_token` | The access token has expired. Refresh it | | 401 | `connection_revoked` | The connection was ended, or the member who made it left the firm. Connect again | | 403 | `member_removed` | The admin a key acts as is no longer in the firm | A 401 carries a `WWW-Authenticate` header that names the protected resource metadata, so an OAuth client can find where to sign in. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.