Least privilege
RevDesk API authentication and OAuth
Authenticate RevDesk API and MCP clients with organization-scoped credentials, named permissions, RFC 9728 protected-resource metadata, and explicit revocation.
What it is
RevDesk production access is organization-scoped. A signed-in organization member approves an OAuth grant or creates an API key, selects the smallest named scope set needed by the integration, and stores the credential in the client host's secret manager. RevDesk publishes OAuth authorization-server metadata and RFC 9728 protected-resource metadata so machines can discover the resource, supported bearer method, and available permissions without relying on prose alone.
When to use RevDesk API authentication and OAuth
- Choose the exact read or write permissions for an API, SDK, CLI, or MCP integration.
- Recover from a 401, missing-scope 403, expired credential, or revoked key.
- Build a credential workflow that keeps a person in control of production access.
Recommended workflow
- 1Read protected-resource metadata and the OpenAPI operation's security requirement.
- 2Create a separate key per agent and environment, selecting only the scopes the task needs.
- 3Send the key as an HTTP Bearer credential, rotate it deliberately, and revoke it immediately when access is no longer required.
Safety and approval boundaries
- RevDesk does not currently advertise anonymous agent credential claims or dynamic client registration for v1 API keys.
- A credential must never be placed in a prompt, browser URL, source file, or public log.
- Possessing a write scope does not replace user approval for costly or externally visible actions.
