Authentication

STACK accepts different credentials for operators, integrations, agents, and partners. Each route still applies its own role and security rules.

Authorization Header

Authorization: Bearer $STACK_TOKEN

Operator API key

The long-lived operator key uses the sk_live_ prefix and can be regenerated in the Console. It authenticates as the operator account and is not scoped to one workload or service connection, although route-specific step-up, partner and platform-staff checks still apply. Treat it as a full-account credential.

curl https://api.getstack.run/v1/agents \
  -H "Authorization: Bearer $STACK_API_KEY"

OAuth Access Tokens

MCP clients, the CLI and other authorized integrations use short-lived OAuth access tokens. A member token carries the member's role and service-connection restrictions. Use OAuth instead of copying the operator key into an interactive client.

Console Sessions

The Console uses a signed session cookie. The API resolves the current operator or member from that session. Do not copy the cookie into scripts or external clients.

Agent JWTs

Customer-managed agents enroll a public key and exchange a signed challenge for a short-lived agent JWT. Agent contexts cannot call governance, billing, identity, credential-expansion, or other operator-only routes.

Partner Grant Tokens

Partner grants use the sk_grant_ prefix. Each grant is limited to approved routes, scopes, providers, and resources created through that grant.

Passport Tokens

A passport proves agent identity and delegated scope for an action. Send it in X-Passport-Token when a route requires it. It does not replace the bearer credential on normal operator API calls.

Authorization: Bearer $STACK_TOKEN
X-Passport-Token: $STACK_PASSPORT