Choose the right authentication
Use a credential supported by the specific Message API surface.
Reviewed against the implementation · September 25, 2026
Agent sessions
The dashboard signs agents into a workspace. Agent-session endpoints enforce roles and workspace access. Keep bearer tokens private and re-authenticate when a session expires or is revoked. Never embed an agent token into a public widget or browser snippet.
Workspace API credentials
Supported integration and automation endpoints accept workspace-scoped API keys. Follow the API-key guide for the current key format, scopes and creation flow. Do not assume that a workspace API key can access every dashboard route.
Public widget access
The website widget uses the published embed setup and site identifier. A site identifier is not an administrator credential, and browser visitor continuity is not verified account ownership.
Provider OAuth
Connecting Google, Microsoft or another provider grants the configured connector access after account authorization. It does not convert the provider token into a general Message API credential. Store integration secrets only on the server.
Handle failures
Treat 401 as an authentication problem and 403 as a permission problem. Stop a failing request loop, preserve the user’s draft where applicable and ask for a fresh authorized session. Never retry a write blindly without checking its result.