API keys & OAuth connections

Both API keys and OAuth connections appear in Settings → Connections and carry a scope, an optional per-expense cap, and instant revocation.

API keys

A long-lived bearer token you generate and give to a script or integration without a browser consent flow. It is scoped read or read_write, shown once, and revocable any time. Free includes up to two active keys; Pro is unlimited.

OAuth connections

For clients that support it, the agent redirects you to AgentCents. You review plain-language permissions and approve or deny. The client gets a short-lived access token and can refresh it automatically; no API key changes hands.

Which to use

Prefer OAuth when supported. Use an API key for scripts, self-hosted software, or clients without OAuth. Give read-only access when possible; for writing, add a per-expense cap so larger entries wait for human review.