> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nonce.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and access

> Choose a credential and understand workspace and farm access.

Workspace data requires authentication. Public API v2 accepts a workspace API key or an OAuth access token in the same header:

```http theme={null}
Authorization: Bearer <credential>
```

[Get Bitcoin Metrics](/api-reference/v2/bitcoin/get-bitcoin-metrics) is public and does not require this header.

## Workspace API keys

API keys are intended for server-side applications, scripts, and services. In the [Nonce app](https://nonce.app), select the workspace, open **Manage**, and choose **API Keys**. The API Keys view is visible to users with `workspace.manage`. Developers without this permission should obtain a key from a workspace administrator.

A workspace API key acts for its owning workspace and has administrator permissions there. It does not inherit the personal role of the developer running the script. Keep keys in server-side environment variables or a secret manager, exclude them from browser code and source control, and keep them out of logs.

## OAuth

OAuth requests act for the authenticated user. Access depends on the user's membership, role, and assigned farms in each workspace. [MCP clients](/api-guide/mcp) obtain and manage OAuth credentials through the Nonce connection flow.

## Resource access

Permission and resource scope are separate: a permission allows an action, while farm scope limits where that action can be performed. Farm and Agent reads require `farm.read`; miner and task batch reads require `miner.read`.

`ListWorkspaces` returns the accessible workspaces. On each item, `permissions` lists the allowed API actions, and `relations` distinguishes membership (`member`) from granted access (`grantee`). Accessible farms are listed separately by `ListFarms`.

For cross-workspace API key requests, the target workspace must have an active authorization grant to the key's workspace. Access is read-only and limited to the farms covered by that grant.

## Access errors

| Status | Meaning                                                                             |
| ------ | ----------------------------------------------------------------------------------- |
| 401    | Missing, invalid, or expired credentials                                            |
| 403    | The credential lacks the required permission, workspace membership, or active grant |
| 404    | The scoped resource does not exist or is outside the accessible farm scope          |

See [Requests and responses](/api-guide/v2/requests) for the error format and [Roles and permissions](/user-guide/permissions/role-overview) for the role model.