Authentication
A session for a person, an API key for a program, and what no key may ever do.
There are two ways to be someone. A session cookie is a person in a browser and can do anything they are allowed to do. An API key is a program: it can do a subset, bounded by the key's scopes, and is explicitly barred from a few things regardless of scope.
Using a key
Authorization: Bearer tsn_cloud_...A key's secret begins tsn_cloud_ and is shown exactly once, when it is created. Tessen stores only a hash — there is no endpoint that returns it again, and nobody at Tessen can read it.
Scopes
| Scope | What it covers |
|---|---|
| read | Reading your own data — plans, projects, files, usage, search. |
| build | Starting an execution. |
| deploy | Deployment operations. |
| domains | Domain management. |
| agents | Creating and running agents, and anything that proposes work. |
| admin | Implies all of the above. |
The scope list is exactly read, deploy, build, domains, agents, admin. A route that a key may use declares the scope it needs; a request without it answers 403.
What no key may do, at any scope
- Mint or manage keys — a leaked key must not be able to bootstrap a stronger one.
- Exercise a person's data rights under /api/consent — granting, revoking, exporting or deleting consent is the human asserting control over their own information, and a token is not that human.
Both refusals are enforced at the door rather than per route, so a new endpoint inherits them without anyone having to remember.