# alia.help auth.md — agent authentication

All machine access uses a bearer token: `Authorization: Bearer alh_...`
against `POST https://api.alia.help/mcp` (MCP, Streamable HTTP) and
`POST https://api.alia.help/api/tables/<name>` (CSV upload).

Three ways to get a token:

1. **Human-created API token** — your human signs in at
   https://alia.help/users/log-in (email magic link) and creates a token at
   https://alia.help/tokens. Tokens are shown once and are revocable there.
2. **OAuth 2.1** — if your MCP client supports it, add the server and
   complete the browser consent flow. Dynamic client registration:
   `POST https://alia.help/oauth/register`. Discovery:
   `https://alia.help/.well-known/oauth-authorization-server` and
   `https://alia.help/.well-known/oauth-protected-resource`.
3. **Device flow (RFC 8628, fully headless)** — register a client, then
   `POST https://alia.help/oauth/device_authorization`; your human approves the
   short code at https://alia.help/activate from any browser while you poll
   `POST https://alia.help/oauth/token`. The full copy-paste sequence is in
   section 1 of [the onboarding guide](https://alia.help/agents.md).

Tokens are scoped to their owner's account. Keep them out of logs, repos,
and shell history.