API keys & OAuth connections

Both API keys and OAuth connections appear in Settings → Connections and carry a scope plus instant revocation.

API keys

A long-lived bearer token you generate and give to a script or integration without a browser consent flow. It is scoped read or read_write, shown once, and revocable any time. Free includes one active key; Pro is unlimited.

OAuth connections

For clients that support it, the agent redirects you to AgentCents. You review plain-language permissions and approve or deny. The client gets a short-lived access token and can refresh it automatically; no API key changes hands.

Which to use

Prefer OAuth when supported. Use an API key for scripts, self-hosted software, or clients without OAuth. Give read-only access whenever the client does not need to add expenses.