# Authentication and authority

> Understand Public REST API keys, publishing service credentials, signed-in Console sessions, and delegated MCP credentials before integrating EntireFeed.

Canonical: https://entirefeed.com/docs/get-started/authentication

EntireFeed uses separate credentials because each surface represents a different authority model. Select the credential by the route or tool you are calling, not by convenience.

## Authority is surface-specific

Public discovery and estimation are unauthenticated. Public execution and organization-scoped generation API reads use a Public REST API key. Narrow unattended publishing uses an organization service credential. Browser Console actions use a signed-in session. Console MCP uses a separately revocable delegated credential for the current user and organization.

Never substitute one credential for another. Console publishing routes do not accept an `efapi_live_...` key, generation routes do not accept an `efsvc_live_...` credential, and Public REST routes do not treat an `efmcp_live_...` credential as an API key.

## Handle secrets once

API key, publishing service credential, and MCP secrets are shown in full when they are created. Store them in a secret manager, name credentials by integration and environment, and rotate or revoke credentials that are exposed or no longer needed. Service credentials may also expire.

## Credential matrix

| Surface | Credential | Authority |
| --- | --- | --- |
| Public discovery and estimate | `None` | Current public task, model, pricing, and request estimate contracts |
| Public REST execution | `efapi_live_...` | Organization-scoped execution and reads; any active REST key for the organization can access its public operations |
| Unattended publishing REST | `efsvc_live_...` | Organization-scoped selected publishing capabilities, intersected with current workspace policy on every request |
| Signed-in Console | `Session cookie or Console token` | The current user, organization membership, role, and capabilities |
| Console MCP | `efmcp_live_...` | Delegated current-user authority, re-evaluated on every request |

## Public REST API keys

Create keys in [Console](https://console.entirefeed.com) and send them as `Authorization: Bearer efapi_live_...`. The key is organization-scoped, is shown in full once, and should be named and revoked per integration. Public discovery and `POST /v1/estimate` do not require it.

## Publishing service credentials

An owner or admin can create a publishing service credential in [Console credentials](https://console.entirefeed.com/settings/credentials). Send the one-time `efsvc_live_...` secret as a Bearer token only to the documented upload and publishing routes. Selected grants and the workspace's current customer-type policy are both enforced on every request; this credential cannot run generation, workflows, warmup, products, generic billing, or top-ups. Rotate or revoke it independently from personal sessions and MCP credentials.

## Signed-in Console sessions

Passwordless email sign-in establishes a browser session for Console routes. The session acts as the current user in the selected organization and is constrained by current membership, role, and capabilities. Do not export the browser cookie as an integration credential.

## Delegated MCP credentials

Create a separate `efmcp_live_...` credential for a trusted MCP client. It delegates the owner's current Console authority and can be revoked independently from browser sessions and REST keys. Membership or role changes take effect when each MCP request resolves.