Authentication

Access tokens: minting, scopes, expiry, revocation, and how to send one.

Both surfaces authenticate with a Studio access token. A token belongs to one account, carries a subset of four scopes, may expire, and can be revoked at any time. The server stores only a hash; the plaintext is shown once when it is minted.

#Mint a token

Open Account > Developer
Sign in at /studio and open the Account view. The Developer card lists your tokens and the plan’s allowance.
Name it for what will use it
One token per script, notebook or agent. When one leaks, you revoke that one and nothing else stops.
Pick scopes and an expiry
The default scopes read and write scenarios and read runs. runs:write is off by default because it spends money. An expiry is optional; short-lived tokens for CI are a good habit.
Copy it
The token is dsk_ followed by 64 hex characters. It is shown once. Store it in a secret manager or an environment variable, never in a repository.

#Send it

Send the token as a Bearer header on every request. The REST API also accepts an x-api-key header, and the MCP server accepts an api_key argument on any tool for clients that cannot set headers.

GET /api/v1/me HTTP/1.1
Host: daishi.ai
Authorization: Bearer dsk_1a2b3c4d...

GET /api/v1/me HTTP/1.1
Host: daishi.ai
x-api-key: dsk_1a2b3c4d...

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "whoami",
    "arguments": {
      "api_key": "dsk_1a2b3c4d..."
    }
  }
}

#Scopes

A scope is a hard boundary. A call outside the token’s scopes answers 403 scope_required whatever the plan, and an agent holding a token without runs:write cannot launch no matter what it is told.

Scope	Allows	Implies
`scenarios:read`	List and read your scenarios, the schema, the library and the anchors; validate a definition.
`scenarios:write`	Create, update and delete scenarios.	`scenarios:read`
`runs:read`	List and read your runs and their results; estimate a run.
`runs:write`	Launch and cancel runs. Spends your monthly agent turns and your own model keys, so it is off by default.	`runs:read`

#What a token can never do

Mint another token, change the account, read or write stored provider keys, touch billing, or reach another account’s scenarios and runs. Ids from other accounts read as unknown. Those actions stay behind the signed-in session in the Studio.

#Expiry and revocation

A token past its expiry, or revoked from the Developer card, answers 401 token_required from that moment. Revocation is immediate; there is no grace period. The card shows when each token was last used, so an idle one is easy to spot and retire.

#Rate limits

Each token has a per-minute ceiling set by the plan (see Plans and limits). Above it, calls answer 429 rate_limited until the minute rolls. Unauthenticated and refused requests are limited per address as well, so a misconfigured client cannot hammer the sign-in surface.

#Security events

Minting and revoking a token writes a security event on the account and sends the account email a notice, so a token you did not mint is visible the moment it appears.