# Access and consent

Keep the connection’s permissions as small as the work requires. Agent grants authorize API operations; human actions and native-device permissions remain separate decisions.

HTML: https://notify.belweave.ai/docs/access

## Agent credentials and scopes

Agent HTTP requests use `Authorization: Bearer ntf_…`. Create a named, scoped key in [Dashboard → API keys](https://notify.belweave.ai/dashboard#api-keys), or use CLI device authorization. Missing route scopes return `403` with a `required` list. Resource access is constrained to the token’s account and permitted shared resources; foreign resource IDs return `404`.

For a server integration, choose Create API key, give it a recognizable name, and review its scopes and expiry. The Server integration preset grants `notifications:send`, `interactions:create`, and `services:write`; the default expiry is 90 days. Copy the secret when it appears and save it in your server’s secret store: it is shown only once. Revoke a key from API keys when the integration no longer needs access.

For terminal use, `notify auth login` remains the browser authorization flow. MCP clients can continue using OAuth at `https://notify.belweave.ai/mcp`; neither workflow requires manually creating a dashboard key.

- The default CLI login requests all agent scopes except `events:read` and `tokens:manage`. Explicit `--scope` flags replace the default scope set; repeat the flag for each permission you need.
- Older/narrower connections may lack device, inbox, billing, team, on-call, or connector scopes. Compare `auth status` with the reference’s route requirements and reauthorize only what you need.
- Agent service list/get omit webhook URLs. Create/rotate reveal the URL once; signed-in dashboard access is separate.

## Actions reserved for a person

A scoped connection can perform supported operational work, but it cannot make these identity or consent decisions. Use the signed-in website or native client where that human action is available:

- Answer a question: only a human may approve, deny, choose yes/no, or submit a reply. Agents can read and cancel.
- Create API tokens: minting a broader token would defeat the calling token’s scope/lifetime. `tokens:manage` permits listing and revoking existing tokens only.
- Approve hosted-app sign-in, select profile sharing, or issue a Notify pass. Changing an app’s origin resets its approval.
- Register a device through its native client and push-token flow.
- Accept a family or workplace invitation.
- Acknowledge or escalate a page.