# Authentication and scopes > Every call sends an agency API key as a bearer token; each key carries the scopes it was created with. Send `Authorization: Bearer ` on every request. Owners create keys in **Settings › Integrations › API keys**; a key is shown once, can carry an expiry date, and can be revoked at any time. Live keys and test keys look alike (`r100x_live_…` or `r100x_test_…`); which mode a key is in is decided by the key itself, not by its prefix. `GET /api/v1/me` tells you the workspace, the key's name and scopes, `livemode` and your limits. ## Scopes | Scope | Name | What it allows | Default | |---|---|---|---| | `read:reports` | Read reports | Report details, including candidate contact details and quotes. | ticked | | `read:roles` | Read roles | Your roles and their invitation counts. | ticked | | `write:invites` | Send invitations | Add candidates and send them interview invitations (uses credits when they finish). | ticked | | `manage:hooks` | Manage hooks | Let Zapier or Make subscribe to events. | ticked | | `mcp:read` | AI agent: read | An AI agent (MCP) may see your roles, screening reports and usage. | offered, unticked (AI agents) | | `mcp:manage` | AI agent: manage roles | An AI agent (MCP) may create roles, approve screening guides and ask you for decisions. | offered, unticked (AI agents) | | `mcp:screen` | AI agent: send screenings | An AI agent (MCP) may invite candidates by email or text (uses credits when they finish). | offered, unticked (AI agents) | | `mcp:share` | AI agent: share shortlists | An AI agent (MCP) may create client shortlist links for candidates you advanced. | offered, unticked (AI agents) | | `mcp:handoff` | AI agent: send to ATS | An AI agent (MCP) may send candidates you advanced to your ATS. | offered, unticked (AI agents) | | `write:roles` | Create roles | Create and update roles, including from a job link. | offered, unticked | A call that needs a scope the key lacks answers `403 API_SCOPE_MISSING`. **Create roles** (`write:roles`) is offered but never ticked by default. ## Webhook endpoints and keys Endpoints created through the API belong to the key's workspace, and each event needs the matching read scope. An endpoint created with a test key receives test events only. ## Keeping keys safe Keep keys on your server, never in a browser or a mobile app. Revoke a key you no longer use; create a new one if a key may have leaked.