Authentication: API keys and OAuth apps

Every request carries a bearer token in its Authorization header. The REST API (/v1) takes only an API key Current made for one of your agents. An app that connects through OAuth reaches Current through the MCP server (/mcp), and its access token works only there.

Authorization: Bearer $CURRENT_API_KEY

Current makes every key. There is no field that takes a key you made yourself, and a request that sends one is refused (reason secret_not_accepted). A live key starts cur_live_ and ends with a short checksum, so a key with a typo is refused before it reaches your data.

• Current shows a key once, when it is made. It keeps only the key's first few characters and a one-way fingerprint, so nobody can show it to you again.
• A key lasts 30, 60 or 90 days, chosen when it is made; 90 is the default and the most.
• A key nobody has used for 30 days is switched off automatically, and your tenant admins get a notification.
• Keys made before typed keys started with cur_ alone. They keep working until they expire.

A key carries only the scopes it was given. An endpoint outside them answers exactly like one that does not exist.

A key with tickets:write must have an IP allowlist: the addresses or ranges it may call from, each a /16 or narrower (a /48 or narrower for IPv6). A call from any other address is refused with the same 401 as a wrong key, so a stolen key is no use from anywhere else. A read-only key may have one too.

An allowlist may not contain 2a06:98c0:3600::103. Cloudflare gives that address to every Cloudflare Worker, so allowing it would let any Worker on the internet use the key.

• Rotate makes a new key and shows it once. The old key keeps working for the time you pick (1 hour, 24 hours, 3 days or 7 days; 24 hours is the default), so you can swap it into your tool first. Then the old one stops.
• Revoke stops a key at once. Use it the moment a key may have been seen by someone else.
• A key stops on its expiry date by itself. Rotate it before then.
• A key belongs to your workspace, not to the admin who made it. It keeps working if that admin leaves or stops being a tenant admin, and any other tenant admin can revoke it on the API access page.
• API access › Keys lists every live key in the workspace: your agents' keys and the personal MCP keys people made for their own AI apps. A tenant admin can revoke any of them there. Nobody can see a key again, not even a tenant admin. In a support session the list is not shown, but revoking a key or removing an app still works.

Some tools connect on your behalf instead of using a key: an app built for many MSPs, or an AI assistant that reads your tickets while you talk to it. They connect with OAuth 2.1, the authorization code flow with PKCE (S256 only; plain is refused). The app never sees a password and never gets a key. Its token works only at the MCP server's address, /mcp.

1. 1
   The app sends you to Current

   Current's page names the app, who publishes it, which workspace it will read, and what it asks for, such as "read your service desk tickets". Claude and ChatGPT are already approved by Current, so a tenant admin can connect them without asking anyone. Any other app Current has not reviewed can be approved only in the workspace that registered it.
2. 2
   A tenant admin approves

   Only a tenant admin of the workspace can approve, never a super admin and never from inside a support session. The app then reads as that admin, narrowed to what was approved, in this workspace only.
3. 3
   The app gets its tokens

   An access token lasts 1 hour. A refresh token lasts 30 days and changes on every use. If the same app presents a used one again within 30 seconds (a retry), it is refused and nothing else happens; after that, it stops the whole family of tokens and tells your tenant admins.

• Apps can only read. An app connected through OAuth never gets a tool that changes, sends or deletes anything, whatever it asks for.
• Claude and ChatGPT are approved by Current. Any other app, including an AI assistant that registers itself, is refused until Current has reviewed it. An app your own workspace registers can be approved in your workspace before then; a workspace can register at most 50 apps of its own.
• If the admin who approved an app stops being a tenant admin or is switched off, the app's access stops. Another tenant admin approves it again.
• Approving an app again (for example after reconnecting it) stops every token it held before, so only the new connection keeps working.
• Each token is bound to the MCP server it was issued for (the resource). It is never accepted by the REST API.
• A client finds every endpoint on its own from the authorization server metadata at /.well-known/oauth-authorization-server on the API's address. There is no OpenID Connect discovery document: Current is not an OpenID provider and issues no ID token.
• The answer that sends the person back to the app carries iss, Current's issuer, beside code and state. Check that it matches the issuer in the metadata.
• Check that state matches the one you sent, and refuse the answer otherwise.

Settings › Users and roles › API access › Apps lists every app approved for your workspace, who approved it, what it may do and when it last called (or No calls in the last 30 days). Remove access stops it at once. Its calls appear in the call log beside your keys' calls.