Skip to main content
Every /api/* route requires an actor. A request without one returns 401 { "error": "unauthorized" }.

​
Access token

Send a WorkOS access token as a bearer token.
The API verifies the token against the WorkOS issuer JWKS. The audience is the Method MCP resource or the machine audience. The token acts in the user’s organization. Every query is scoped to that organization. An MCP client receives this token from the server’s OAuth discovery flow with scopes openid profile email offline_access.

​
Dashboard session

The dashboard uses a workflow_session cookie set by GET /auth/login and GET /auth/callback. The cookie lasts 7 days. Do not copy that cookie into an integration.

​
Upload token

The recording upload routes use a separate token from the upload link:
The token authorizes one upload ID until the link expires.

​
Keep tokens private

Keep access tokens on your server. Do not put them in browser code, file URLs, prompts, supporting files, or run results.