Workspace API keys
API keys are intended for server-side applications, scripts, and services. In the Nonce app, select the workspace, open Manage, and choose API Keys. The API Keys view is visible to users withworkspace.manage. Developers without this permission should obtain a key from a workspace administrator.
A workspace API key acts for its owning workspace and has administrator permissions there. It does not inherit the personal role of the developer running the script. Keep keys in server-side environment variables or a secret manager, exclude them from browser code and source control, and keep them out of logs.
OAuth
OAuth requests act for the authenticated user. Access depends on the user’s membership, role, and assigned farms in each workspace. MCP clients obtain and manage OAuth credentials through the Nonce connection flow.Resource access
Permission and resource scope are separate: a permission allows an action, while farm scope limits where that action can be performed. Farm and Agent reads requirefarm.read; miner and task batch reads require miner.read.
ListWorkspaces returns the accessible workspaces. On each item, permissions lists the allowed API actions, and relations distinguishes membership (member) from granted access (grantee). Accessible farms are listed separately by ListFarms.
For cross-workspace API key requests, the target workspace must have an active authorization grant to the key’s workspace. Access is read-only and limited to the farms covered by that grant.
Access errors
See Requests and responses for the error format and Roles and permissions for the role model.