Least privilege
RevDesk API authentication and OAuth
Authenticate RevDesk API and MCP clients with organization-scoped credentials, named permissions, RFC 9728 protected-resource metadata, and explicit revocation.
What it is
RevDesk production access is organization-scoped. A signed-in organization member creates an API key, selects the smallest named scope set needed by the integration, and stores the credential in the client host's secret manager. RevDesk publishes OAuth authorization-server metadata and RFC 9728 protected-resource metadata so machines can discover the resource, supported bearer method, and available permissions without relying on prose alone.
When to use RevDesk API authentication and OAuth
- Choose the exact read or write permissions for an API, SDK, CLI, or MCP integration.
- Recover from a 401, missing-scope 403, expired credential, or revoked key.
- Build a credential workflow that keeps a person in control of production access.
Recommended workflow
- 1Read protected-resource metadata and the OpenAPI operation's security requirement.
- 2Create a separate key per agent and environment, selecting only the scopes the task needs.
- 3Send the key as an HTTP Bearer credential, rotate it deliberately, and revoke it immediately when access is no longer required.
Safety and approval boundaries
- RevDesk does not currently advertise anonymous agent credential claims or dynamic client registration for v1 API keys.
- A credential must never be placed in a prompt, browser URL, source file, or public log.
- Possessing a write scope does not replace user approval for costly or externally visible actions.