# Authentication

Compute requests use `Authorization: Bearer sit_live_...`. API keys are user-owned, shown once, independently revocable, limited to three active keys, and may carry an expiry and scopes. Query-string authentication is forbidden.

The first key requires an approved permanent mailbox, server-validated Turnstile, explicit scanner-safe magic-link confirmation, and a verified authenticated proxy connector. Opening the emailed GET link does not consume it; the user must submit the protected confirmation form. Raw API keys and magic-link tokens are never persisted.

Scopes: `scrape:http`, `scrape:render`, `map`, `batch`, `crawl`, `jobs:read`, `jobs:cancel`, `connectors:read`, `connectors:write`, `captcha:use`, `llm:use`, and `profile:write`. Entitlement and current runtime policy may further restrict a granted scope.