Adrata Developers

Authentication

Use scoped workspace API keys or OAuth tokens with explicit route scopes and per-agent token identity.

Headers

Authorization: Bearer adrata_live_...
Adrata-Version: 2026-05-23
X-Request-ID: caller-generated-ulid

Scopes

Keys and OAuth tokens carry least-privilege scopes. Agent tokens include `agent_id` in introspection and audit logs so human users and non-human agents are not conflated.

Token types

Use workspace API keys for server-to-server integrations, OAuth for user-authorized applications, and agent tokens for non-human workflows that need separate audit identity.

SCIM and SAML are available for enterprise identity management. OAuth introspection and revocation endpoints let platforms verify and rotate credentials without creating support tickets.

Security default

Pin `Adrata-Version`, send `X-Request-ID`, scope credentials to the smallest route family, and rotate any key that appears in logs or client-side code.