Access and consent

Agent HTTP requests use Authorization: Bearer ntf_…. Create a named, scoped key in Dashboard → API keys, or use CLI device authorization. Missing route scopes return 403 with a required list. Resource access is constrained to the token’s account and permitted shared resources; foreign resource IDs return 404.

For a server integration, choose Create API key, give it a recognizable name, and review its scopes and expiry. The Server integration preset grants notifications:send, interactions:create, and services:write; the default expiry is 90 days. Copy the secret when it appears and save it in your server’s secret store: it is shown only once. Revoke a key from API keys when the integration no longer needs access.

For terminal use, notify auth login remains the browser authorization flow. MCP clients can continue using OAuth at https://notify.belweave.ai/mcp; neither workflow requires manually creating a dashboard key.

• The default CLI login requests all agent scopes except events:read and tokens:manage. Explicit --scope flags replace the default scope set; repeat the flag for each permission you need.
• Older/narrower connections may lack device, inbox, billing, team, on-call, or connector scopes. Compare auth status with the reference’s route requirements and reauthorize only what you need.
• Agent service list/get omit webhook URLs. Create/rotate reveal the URL once; signed-in dashboard access is separate.

A scoped connection can perform supported operational work, but it cannot make these identity or consent decisions. Use the signed-in website or native client where that human action is available:

• Answer a question: only a human may approve, deny, choose yes/no, or submit a reply. Agents can read and cancel.
• Create API tokens: minting a broader token would defeat the calling token’s scope/lifetime. tokens:manage permits listing and revoking existing tokens only.
• Approve hosted-app sign-in, select profile sharing, or issue a Notify pass. Changing an app’s origin resets its approval.
• Register a device through its native client and push-token flow.
• Accept a family or workplace invitation.
• Acknowledge or escalate a page.