Currents Authentication

generated: '2026-11-04'
method: searched
source: https://docs.currents.dev/api/get-started/authentication.md, https://docs.currents.dev/authentication/authentication.md, https://docs.currents.dev/authentication/oauth.md, https://docs.currents.dev/authentication/personal-access-tokens.md,
  https://docs.currents.dev/dashboard/administration/api-keys.md
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: RecordKey
  type: apiKey
  in: header
  parameter: x-currents-key
  description: An organization's record key, the one a reporter sends. Accepted only by the two attachment routes under `/runs`, `POST /runs/{runId}/context-links`, `POST /sessions`, `POST /sessions/{sessionId}/attachments`
    and, for a session, `POST /share`, so a CI job can attach files, link its failed and flaky tests, record a session and share it with the key it already has.
  sources:
  - openapi/currents-dev-openapi.yml
- name: BearerAuth
  type: http
  scheme: bearer
  description: 'An organization API key, sent as `Authorization: Bearer <key>`. A key carries one scope for the whole API: a `read` key reaches the GET endpoints, a `write` key reaches all of them. A `crnts_pat_`
    personal access token is accepted as a Bearer while its owner remains an eligible administrator in its active organization. Each operation requires the corresponding scope stored on that token.'
  sources:
  - openapi/currents-dev-openapi.yml
  - openapi/currents-dev-trace-api-openapi.yml
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://id.currents.dev/api/auth/oauth2/authorize
    tokenUrl: https://id.currents.dev/api/auth/oauth2/token
    scopes: 11
  description: 'An access token from the Currents authorization server, for an application acting as a user in one organization. Unlike an API key it is confined per endpoint: the operation lists the scope
    it needs, and a token that was not granted that scope gets 403.


    **The endpoints below are production''s.** They are written out so this specification can be exercised against production, and they are wrong for '
  sources:
  - openapi/currents-dev-openapi.yml
docs: https://docs.currents.dev/authentication/authentication
documented:
  api_keys: 'Organization-wide keys sent as `Authorization: Bearer <key>` over HTTPS; two permission levels, Read Only (GET endpoints plus trace API links) and Read & Write. A Read Only key attempting a
    write is rejected with HTTP 403. Only organization Admins create or revoke keys.'
  record_key: x-currents-key header, used by reporters/CI for run attachments, context links, sessions and share links.
  personal_access_tokens: Prefix crnts_pat_, sent as Bearer; expiry required at creation, max one year, default 30 days; owner must remain an eligible administrator.
  oauth2:
    authorization_server: https://id.currents.dev
    metadata: https://id.currents.dev/.well-known/oauth-authorization-server
    protected_resource_metadata:
    - https://api.currents.dev/.well-known/oauth-protected-resource
    - https://mcp.currents.dev/.well-known/oauth-protected-resource/mcp
    grant_types:
    - authorization_code
    - refresh_token
    pkce: Required, S256
    dynamic_client_registration: false
    client_identification: Client ID Metadata Document
    audience: 'Tokens are audience-bound: REST API tokens are refused by the MCP endpoint and vice versa.'