---
title: Authentication
description: Choose between API keys and OAuth 2.1 access tokens.
---

torqee Connect accepts Bearer credentials on every REST and MCP request except
public metadata endpoints.

| Method    | Best for                                                      | How it works                                                                                                     |
| --------- | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| API keys  | Server-to-server jobs, agents, and trusted backend tools.     | A `torqee_` key is issued from the torqee web app and sent as a Bearer token.                                    |
| OAuth 2.1 | User-facing integrations that need explicit end-user consent. | The client runs authorization code with PKCE against torqee Auth and requests Connect as the protected resource. |

Both methods are workspace scoped. A credential reads only the workspace it was
issued for, and only the scopes granted to that credential.

Use API keys when you operate the integration yourself. Use OAuth when another
user or organization authorizes your app.

Webhook endpoint management uses `torqee:webhooks:read` and
`torqee:webhooks:write`. Event subscriptions additionally require the read
scope for the event data, such as `torqee:sessions:read` for session lifecycle
events. See the [webhook guide](/docs/guides/webhooks) for the complete flow.