# Authentication



> Informational documentation, based on the paper Data Language Models: A New Foundation Model Class for Tabular Data (arXiv:2605.06290, https://arxiv.org/abs/2605.06290). Reference material, not a hosted service; hosts, keys, and ids are placeholders.

Every API request carries an org-scoped API key as a bearer token:

```http
Authorization: Bearer <API key>
```

Keys are created on the platform's **API** page or with `POST /v2/keys`. The secret is shown once, at creation, and never again; listings show the key id (`key_...`) and a preview of the secret. Store secrets in a secrets manager and rotate with `POST /v2/keys/:id/rotate`.

## Two modes, one org

| Mode | Who | How |
|---|---|---|
| Interactive | Humans | Web sign-in on the platform |
| Headless | CI, agents, pipelines, apps | `Authorization: Bearer $API_KEY` |

An endpoint created over the API appears in the platform Endpoints list immediately.

## Scopes

Outputs are bundled, so keys are never scoped per output. They are scoped by operation:

| Scope | Allows |
|---|---|
| `read` | List and get endpoints, data, reports, jobs, usage, models, keys |
| `run` | Stateless inference on the base models: `POST /v2/run` |
| `serve` | Call live endpoints: `POST /v2/serve/:id` |
| `manage` | Create endpoints, refresh, upgrade, connect and sync data, pin and unpin, generate synthetic data, cancel jobs, manage keys |
| `delete` | Delete endpoints and data, revoke keys |

A key can hold any combination. Give production systems the least they need: a pipeline that only serves endpoints needs `serve` alone.

## Errors

| Situation | Response |
|---|---|
| Missing or malformed key | `401` `auth_error` |
| Key revoked | `401` `auth_error` |
| Key lacks the route's scope | `403` `auth_error` |

See the error envelope for the envelope.

## What a key covers

Connection credentials you register are encrypted at rest and write-only.