---
title: "Authentication matrix"
description: "Credential requirements for every Tooluse.net API audience."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.tooluse.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication matrix

<table>
<thead>
<tr>
<th>Audience or route</th>
<th>Accepted credential</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td>Console and session-only management</td>
<td>Clerk session</td>
<td>Human identity required</td>
</tr>
<tr>
<td>General <code>/v1/applications/**</code> management</td>
<td>Clerk session or <code>amqp_</code> personal access token</td>
<td>Role checks still apply</td>
</tr>
<tr>
<td><code>/v1/agent/**</code></td>
<td>Exactly one Bearer <code>amq_</code> Agent key or admitted private Bot execution credential</td>
<td>Application-scoped machine identity</td>
</tr>
<tr>
<td><code>/v1/account/**</code></td>
<td>Clerk session only</td>
<td>A token cannot mint or revoke another token</td>
</tr>
<tr>
<td>Invitation preview and acceptance</td>
<td>Clerk session only</td>
<td>Binds the invited human identity</td>
</tr>
<tr>
<td>Device approval</td>
<td>Clerk session only</td>
<td>Start and poll remain unauthenticated</td>
</tr>
<tr>
<td><code>/v1/topups/stripe/**</code></td>
<td>Clerk session only</td>
<td>Owner authorization and payment consent</td>
</tr>
<tr>
<td>Consumer commands</td>
<td>Consumer OIDC flow and command-specific state/session</td>
<td>Per-user application boundary</td>
</tr>
<tr>
<td>OAuth callback</td>
<td>Single-use OAuth state</td>
<td>No Tooluse.net session required</td>
</tr>
<tr>
<td><code>/v1/platform/**</code></td>
<td>Clerk session for an allowlisted workspace operator</td>
<td>Not an application-member API</td>
</tr>
<tr>
<td><code>/v1/internal/**</code></td>
<td>Configured private service credential</td>
<td>Never expose to public clients</td>
</tr>
<tr>
<td>Webhooks</td>
<td>Provider-specific signature over the raw request</td>
<td>Browser redirects are not payment proof</td>
</tr>
</tbody>
</table>
<h2 id="session-only-path-set">Session-only path set</h2>
<ul>
<li><code>/v1/account/**</code></li>
<li><code>/v1/invitations/preview</code></li>
<li><code>/v1/invitations/accept</code></li>
<li><code>/v1/device/approvals</code></li>
<li><code>/v1/topups/stripe/**</code></li>
</ul>
<h2 id="public-reads-and-bootstrap-calls">Public reads and bootstrap calls</h2>
<p><code>GET /v1/config</code>, <code>GET /v1/purchases/catalog</code>, device start/poll/token collection, the OAuth callback, and signed callbacks have explicit narrow authentication rules. Their availability does not grant application access by itself.</p>

Source: https://help.tooluse.net/reference/authentication/index.mdx