# Authentication

CommSync authenticates external agents and integrations with per-user API
keys. There is no OAuth authorization server and no client registration
flow — if you're looking for `/.well-known/oauth-authorization-server`
or an `agent_auth` block, it doesn't exist here on purpose.

## Get a key

1. Sign in to CommSync.
2. Go to **Settings → API Keys** and create a key.
3. Copy the key immediately — it is shown once as `csk_<48 hex characters>`
   and only a SHA-256 hash is stored afterward.

Keys can optionally be scoped to specific email accounts / phone numbers at
creation or edit time; unscoped keys follow the owner's full channel access,
including channels connected later.

## Use a key

Send it as a Bearer token on every request to the MCP endpoint:

```
POST https://server.commsync.ai/api/mcp
Authorization: Bearer csk_<your_api_key>
Content-Type: application/json
```

The key determines the caller's identity and scope for every operation —
reads and writes are scoped to the key owner's user and org role, exactly
as if that person were using the app.

## Receiving events (webhooks)

Outbound webhook endpoints are self-service: register one with the MCP
`register_webhook` tool (same API key, no separate credential). CommSync
signs each delivery with HMAC-SHA256 in the `X-CommSync-Signature` header,
using a per-endpoint secret returned once at registration — verify that
signature rather than trusting the source IP.

## Reference

- [MCP agent reference](https://commsync.ai/docs/mcp.txt) — full tool catalog and connection details.
- [MCP human docs](https://commsync.ai/docs/mcp)
- [Webhooks agent reference](https://commsync.ai/docs/webhooks.txt) — event catalog, signing, retries.
- [API catalog](https://commsync.ai/.well-known/api-catalog) — RFC 9727 index of both HTTP surfaces.
- [API keys](https://commsync.ai/docs/api-keys) — the human walkthrough for minting and scoping a key.