Authentication
Choose between API keys and OAuth 2.1 access tokens.
torqee Connect accepts Bearer credentials on every REST and MCP request except public metadata endpoints.
| Method | Best for | How it works |
|---|---|---|
| API keys | Server-to-server jobs, agents, and trusted backend tools. | A torqee_ key is issued from the torqee web app and sent as a Bearer token. |
| OAuth 2.1 | User-facing integrations that need explicit end-user consent. | The client runs authorization code with PKCE against torqee Auth and requests Connect as the protected resource. |
Both methods are workspace scoped. A credential reads only the workspace it was issued for, and only the scopes granted to that credential.
Use API keys when you operate the integration yourself. Use OAuth when another user or organization authorizes your app.