> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# auth.md

> Authentication and credential provisioning for agents using Orq.ai.

## Public documentation

Read **Orq.ai** documentation and use the documentation MCP server at `https://docs.orq.ai/mcp` without authentication. Discover API schemas and the documentation MCP server through the [capability catalog](https://docs.orq.ai/.well-known/ai-catalog.json).

## API credential provisioning

For agents calling the **Orq.ai** API at `https://my.orq.ai`, provision credentials before making API requests:

1. Create an account at [Sign up](https://my.orq.ai/auth/signup), or sign in to an existing workspace.
2. Create a project-scoped [API key](/ai-studio/organization/api-keys). Use a service account key for production automation; creating one requires a workspace admin.
3. Grant the permissions required by the agent and store the key securely.
4. Send the key in the request header:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer <ORQ_API_KEY>
```

Use the [OpenAPI specification](https://docs.orq.ai/openapi.json) to discover operations and their authentication requirements. Manage, revoke, or replace API keys through **Settings > API Keys**; see [Secrets management](/ai-studio/organization/secrets) for rotation instructions.

## Workspace MCP authorization

Connect an OAuth-capable MCP client to `https://my.orq.ai/v2/mcp` and complete the browser sign-in and workspace consent flow. An existing API key can also authenticate requests to this endpoint.

* Resource metadata: `https://my.orq.ai/.well-known/oauth-protected-resource/v2/mcp`
* Authorization server metadata: `https://my.orq.ai/.well-known/oauth-authorization-server/v2/auth/mcp`
* OAuth issuer: `https://my.orq.ai/v2/auth/mcp`
* OAuth client registration: `https://my.orq.ai/v2/auth/mcp/register`
* Supported grants: `authorization_code` and `refresh_token`, with PKCE `S256` required for authorization.

OAuth client registration registers an MCP client; it does not create an **Orq.ai** user or workspace. Read the discovery documents for supported scopes and current authorization, token, and revocation endpoints. See the [workspace MCP guide](/ai-studio/integrations/code-assistants/orq-mcp) for client setup.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.