401. Data access is scoped to the actor’s organization.
Full CLI
Runmethod login. The CLI opens a browser for sign-in and computer approval (the program in $BROWSER when it is set), then stores a private credential under ~/.config/method. Online commands can start this flow when no credential is saved. The credential is specific to the selected server.
The CLI sends its computer credential in the Authorization: Bearer header. Use method status to check access, method devices to list computers (this_computer is true for the computer that asks), and method revoke DEVICE_ID or method logout to revoke access. Do not copy these credentials into chat or Method files.
Service keys
Apps and workers use an organization service key:mk_live_ and random characters, sent as Authorization: Bearer KEY. method connect APP_FOLDER makes one and writes it to the app’s .env as METHOD_API_KEY without showing it. method keys create --name NAME makes one and prints it and its webhook secret once. method keys list and method keys revoke KEY_ID manage keys. With METHOD_API_KEY set, the CLI and the libraries use that key.
MCP and OAuth clients
Connect tohttps://mcp.withmethod.ai/mcp. Use OAuth discovery, PKCE, and token refresh. MCP sends a WorkOS access token to the API. The API checks the issuer, signature, audience, and organization. An OAuth access token is separate from a CLI computer credential.
Dashboard
The browser uses an HTTP-onlyworkflow_session cookie set through /auth/login and /auth/callback. Its lifetime is seven days. Do not copy a browser session into an integration.