Authentication

API keys for servers; OAuth access tokens for MCP agents.

API keys

Create in the Business hub (session only). Format bk_live_ + 48 hex. Send as X-Api-Key or Authorization: Bearer bk_live_…. Secrets are hashed at rest; plaintext shown once.

OAuth (MCP)

Consent at bruce.money/developers/mcp/authorize issues bat_ tokens (default 8h). Use Authorization: Bearer bat_….