---
title: "Bisque Authentication"
description: "API keys, OAuth, what needs no credential, and Idempotency-Key."
canonical: https://bisque.cloud/docs/api/authentication
---

# Authentication

API keys, OAuth, what needs no credential, and Idempotency-Key.

Page: https://bisque.cloud/docs/api/authentication

Reading a public or unlisted presentation needs no credential; everything else sends one bearer credential, an API key or an OAuth token.

## What needs no credential

- `GET /api/presentations/spec` and `GET /api/presentations/spec/{part}`,
  the authoring format.
- `GET /api/presentations/context` and its batch form, for public and
  unlisted presentations. Send a credential to read your own private ones,
  and for the larger [rate limit](/docs/api/errors#rate-limits).
- `GET /api/oembed`.
- `POST /docs/mcp`, the documentation MCP server.

## The header

Both credentials go in the same header, on every call to the REST API and to
the presentations MCP server:

```http
Authorization: Bearer <credential>
```

A missing, expired, or revoked credential is a `401`; see
[Errors](/docs/api/errors).

## API keys

An API key starts with `bisque_live_`. Use one for scripts, CLIs, and coding
agents on your machine. Create it at
[bisque.cloud/setup/keys](https://bisque.cloud/setup/keys), or run
`bisque login`: it prints a pairing code, you approve the code in the
browser, and the key lands in the CLI's config. Keys do not expire; rotate or
revoke them on the same page.

Some endpoints take API keys only: the live creation endpoints under
`/v1/presentations`, and `POST /api/presentations/publish-narrated`.

## OAuth

An OAuth access token starts with `bisque_oat_`. Use OAuth for hosted chat
products where nobody can paste a key, such as a ChatGPT connector or a
Claude custom connector. Bisque is an OAuth 2.1 authorization server with
PKCE (S256) and dynamic client registration; the issuer is
`https://bisque.cloud`. You register a client with no user identity, the
user signs in and approves it, and you exchange the code for a token.

- Access tokens last one hour.
- Refresh tokens last 90 days and rotate on use: the old one is revoked in
  the same call that returns the new pair.
- Scopes: `presentations` (publish, list, and read presentations as the
  user), `openid`, and `email`.

The `/api/presentations/...` endpoints and the presentations MCP server
accept an OAuth token wherever they accept an API key, except the
API-key-only endpoints above. The step-by-step for agents, in the order they
run it, is [`/auth.md`](/auth.md): discovery, registration, the claim,
refresh, and revocation. A user disconnects a client at any time from
bisque.cloud/account, under Connected apps, which revokes every token it
holds.

## Idempotency-Key

Send an `Idempotency-Key` header (a UUID) on every POST that publishes:
`POST /api/presentations/create`, `POST /v1/presentations`, and
`POST /api/presentations/publish-narrated`. If the network drops after the
request went through, retry with the same key and body and you get the first
response back, marked `Idempotent-Replayed: true`, instead of a second
presentation. The same key with a different body is a `422`
`IDEMPOTENCY_KEY_REUSED`. Keys last 24 hours. The [SDK](/docs/api#sdk)
sends one on every POST.

Back to the [API overview](/docs/api). The same credentials work on the
[MCP servers](/docs/mcp).