> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Organization keys, project credentials, client tokens, dashboard bearers, scopes, and live authorization checks.

Polymorfa separates human dashboard identity from three service credential
kinds. A credential is valid only for its intended audience.

| Credential       | Prefix / format | Principal                                       | Typical audience                                                               |
| ---------------- | --------------- | ----------------------------------------------- | ------------------------------------------------------------------------------ |
| Organization key | `titan_…`       | Organization                                    | Server automation and organization-authorized operations                       |
| Project token    | `titan_pt_…`    | One organization and project                    | Messaging API, MCP, or bridge operations that explicitly allow project tokens  |
| Client token     | `titan_ct_…`    | Organization, project, and session/client rules | Short-lived browser, mobile, widget, and explicitly permitted MCP calls        |
| Dashboard bearer | JWT             | Signed-in user and session                      | Dashboard and account routes; also supported by public Platform API operations |

Service credentials use distinct prefixes so they cannot be exchanged between
credential types. Client tokens are not JWTs.

## Bearer header

```http theme={null}
Authorization: Bearer titan_pt_…
```

Use the exact token returned at issuance. Tokens are canonical strings; adding
padding or whitespace is rejected. Secrets are displayed once and cannot be
recovered from stored metadata.

## Requestable project-token scopes

Project tokens use this scope catalog:

```text theme={null}
sessions:read        sessions:manage     messages:write
chats:read           chats:manage        contacts:read
contacts:manage      groups:read         groups:manage
channels:read        channels:manage     status:write
presence:read        presence:write      labels:read
labels:manage        profile:read        profile:write
webhooks:manage      media:read          media:manage
templates:read       templates:manage    campaigns:read
campaigns:manage     mcp                  bridge:connect
```

`*` grants every current project-token scope. Prefer the narrowest explicit
set. Project ownership is checked in addition to the scope bit; a matching
scope never authorizes cross-project access.

The endpoint-only scope names `widget:create`, `sandbox:read`, and
`sandbox:write` cannot be requested on a project token. Follow each endpoint's
documented credential requirements; having a scope name in another credential
catalog does not make it valid for project tokens.

Client tokens do not carry scope bits. Their access is controlled by the
session's exact `allowedActions`, recipient policy, origin rules, and rate
limits. See [Client tokens](/console/client-tokens#session-rules).

Organization keys use the scope stated on each Platform API endpoint. The
published operations use session, campaign, billing, project, and member read
or manage scopes. The generated Platform API reference lists the
required scope for each operation.

## Dashboard authorization

Dashboard requests use a short-lived bearer and verify the active session,
organization, membership, account status, and role on each request. Removing a
member or ending a session takes effect without waiting for the bearer to
expire.

Account security supports passwordless email OTP, passkeys bound to the exact
Console origin, TOTP, optional social providers, invitations, and device login.

## Client and project boundaries

* Project tokens cannot address a session, template, campaign, media object, or
  Meta-compatible identifier owned by another project.
* Client tokens are short-lived and pass through the client-rules middleware.
* MCP requires the project-token `mcp` scope or the client-token `mcp` action.
  Raw bridge connections require the project-token `bridge:connect` scope.
* Each public Platform API operation (`/v1/*`) declares whether it accepts an
  organization key or requires a dashboard bearer. Project tokens are rejected.
* Dashboard-only routes do not accept service credentials unless the
  operation's OpenAPI security explicitly says they do.

## Rotation and incident response

Revoke a suspected credential immediately from the Console or an explicitly
documented revoke endpoint. Confirm that the old credential is rejected before
closing the incident.

Use the generated endpoint page for the exact issuance, metadata, and revoke
shape. Never log or paste full credentials into a ticket.