# Authentication

Source: https://docs.elnora.ai/docs/get-started/authentication
Last modified: 2026-09-08T22:36:08-06:00

> Authenticate to the Elnora API with an API key or OAuth.

Every Elnora API request is authenticated. The base URL is:

```
https://platform.elnora.ai/api/v1
```

## API keys (recommended for scripts & servers)

Create your first key in the dashboard under **Settings → API keys**. Once you
have a key and the [CLI](https://docs.elnora.ai/docs/cli) is authenticated, you can mint more from the
terminal:

```bash
elnora api-keys create --name ci
```

Send it in the `X-API-Key` header on every request (or as
`Authorization: Bearer <your-key>` — both work):

```bash
curl https://platform.elnora.ai/api/v1/tasks \
  -H "X-API-Key: $ELNORA_API_KEY"
```

Keys are prefixed `elnora_live_` and are shown in full **only once**, at creation.
A key inherits the roles of its creator and acts on the creator's organization.
It can read and write the data surfaces — tasks, messages, files, folders, the
library, and search — and on organization endpoints (members, invitations, keys)
it is bound by its creator's role, so an owner's key can invite a member and a
plain member's key cannot. A request a key may not make returns `403` with
`errorCode: "INSUFFICIENT_SCOPE"`. Your organization can set a policy for who may
create keys — see the [API keys reference](https://docs.elnora.ai/docs/api).

**WARN:**

  Treat API keys like passwords. Store them in environment variables or a secrets
  manager — never commit them. Revoke a key anytime from the dashboard or with
  `elnora api-keys revoke`.

## OAuth (interactive clients & MCP)

Interactive clients — including the [MCP server](https://docs.elnora.ai/docs/mcp) — can authenticate
with OAuth 2.1. The client opens a browser to authorize on first connect, then
uses the issued bearer token automatically.

A token is re-checked against your current organization access on every request,
not just when it was issued. If that access ends — you leave the organization, or
it stops being active — requests return `403` with
`errorCode: "ORGANIZATION_ACCESS_REVOKED"`, and the client has to authorize again
rather than retry.

## Enterprise SSO

Enterprise organizations can enable **single sign-on** so members sign in
through their own identity provider (OIDC or SAML). SSO is configured per
organization and is typically invite-only — an admin sets it up, and members
sign in with their work identity. Once signed in, you create and use API keys
exactly as above.

## Organizations

Most resources are scoped to an **organization**. Requests act on your active
organization by default; many endpoints also accept an explicit organization id
to target a specific org. See [Core concepts](https://docs.elnora.ai/docs/get-started/concepts).