> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withmethod.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use a WorkOS access token or the dashboard session.

Every `/api/*` route requires an actor. A request without one returns `401 { "error": "unauthorized" }`.

## Access token

Send a WorkOS access token as a bearer token.

```http theme={null}
Authorization: Bearer <token>
```

The API verifies the token against the WorkOS issuer JWKS. The audience is the Method MCP resource or the machine audience.
The token acts in the user's organization. Every query is scoped to that organization.

An MCP client receives this token from the server's OAuth discovery flow with scopes `openid profile email offline_access`.

## Dashboard session

The dashboard uses a `workflow_session` cookie set by `GET /auth/login` and `GET /auth/callback`. The cookie lasts 7 days. Do not copy that cookie into an integration.

## Upload token

The recording upload routes use a separate token from the upload link:

```http theme={null}
Authorization: WorkflowUpload <token>
```

The token authorizes one upload ID until the link expires.

## Keep tokens private

Keep access tokens on your server. Do not put them in browser code, file URLs, prompts, supporting files, or run results.