Credential boundaries

Authentication and authority

Understand Public REST API keys, publishing service credentials, signed-in Console sessions, and delegated MCP credentials before integrating EntireFeed.

On this page

EntireFeed uses separate credentials because each surface represents a different authority model. Select the credential by the route or tool you are calling, not by convenience.

Authority is surface-specific

Public discovery and estimation are unauthenticated. Public execution and organization-scoped generation API reads use a Public REST API key. Narrow unattended publishing uses an organization service credential. Browser Console actions use a signed-in session. Console MCP uses a separately revocable delegated credential for the current user and organization.

Never substitute one credential for another. Console publishing routes do not accept an efapi_live_... key, generation routes do not accept an efsvc_live_... credential, and Public REST routes do not treat an efmcp_live_... credential as an API key.

Handle secrets once

API key, publishing service credential, and MCP secrets are shown in full when they are created. Store them in a secret manager, name credentials by integration and environment, and rotate or revoke credentials that are exposed or no longer needed. Service credentials may also expire.

Credential matrix

SurfaceCredentialAuthority

Public discovery and estimateNoneCurrent public task, model, pricing, and request estimate contracts

Public REST executionefapi_live_...Organization-scoped execution and reads; any active REST key for the organization can access its public operations

Unattended publishing RESTefsvc_live_...Organization-scoped selected publishing capabilities, intersected with current workspace policy on every request

Signed-in ConsoleSession cookie or Console tokenThe current user, organization membership, role, and capabilities

Console MCPefmcp_live_...Delegated current-user authority, re-evaluated on every request

Public REST API keys

Public RESTAuthorization: Bearer efapi_live_...

Create keys in Console. A key is scoped to one organization, displayed in full once, and independently revocable. Public discovery and estimation do not require it; execution and organization reads do.

Publishing service credentials

Publishing serviceAuthorization: Bearer efsvc_live_...

An owner or admin can create an organization-scoped publishing service credential in Console credentials. Use it only on the documented upload and publishing routes. Selected grants and the workspace's current customer policy are enforced on every request; generation, workflows, warmup, products, generic billing, and top-ups remain unavailable.

Signed-in Console sessions

Signed-in ConsoleHTTP-only browser session

Passwordless email sign-in establishes the current user and selected organization. Console applies the user's current membership, role, and capabilities. Do not export the browser cookie as an integration credential.

Delegated MCP credentials

Console MCPAuthorization: Bearer efmcp_live_...

MCP credentials delegate the owner's current Console authority and can be revoked separately. User role changes, membership removal, organization deletion, and revocation affect access when each request resolves.