Use this page when configuring a client yourself. For guided setup, give your agent the [setup prompt](https://scrollport.com/docs/setup).

## Endpoint

The hosted API is rooted at `https://api.scrollport.com/v1`. The public web app is at `https://scrollport.com`. Send authenticated API requests to the API endpoint, not the website.

## Credentials

The CLI writes its key to `~/.scrollport/credentials.json` with mode `0600`. A hosted runtime should use its platform secret manager. Inject the key at process start, send it in the `Authorization` header and never echo it.

```http
Authorization: Bearer sp_live_<secret>
```

Each key grants access to one workspace. Give each agent its own key so you can review its activity and revoke it separately.

## Environment-specific checks

- Local development: use a dedicated test key and a local or explicitly configured API.
- CI: use test credentials only; never point hermetic tests at the production wallet.
- Hosted runtime: use the production API origin only after the human has approved the device grant.

## Rotation and revocation

Issue a replacement, verify the replacement works with a free `get_wallet` read, then revoke the old key. Never print either key while checking the replacement. If a secret may have leaked, revoke first and investigate second.

The [authentication reference](https://scrollport.com/docs/reference/authentication) explains sign-in, agent access and scopes. The [transports reference](https://scrollport.com/docs/reference/transports) explains HTTP and MCP.