Use this page when configuring a client yourself. For guided setup, give your agent the setup prompt.

Endpoint

The hosted API is rooted at https://api.scrollport.com/v1. The public web app is at https://scrollport.com. Send authenticated API requests to the API endpoint, not the website.

Credentials

The CLI writes its key to ~/.scrollport/credentials.json with mode 0600 inside a 0700 directory. A persistent vault, harness secret store or OS keychain also qualifies as safe retention. A hosted or temporary runtime can connect when that store retains the credential for authorised future sessions. Use the store's secret injection when sending the Authorization header; never echo the key or place it in chat, URLs, logs or committed files.

code

Authorization: Bearer sp_live_<secret>

Each key grants access to one workspace. Give each agent its own key so you can review its activity and revoke it separately.

Environment-specific checks

Local development: use a dedicated test key and a local or explicitly configured API.
CI: use test credentials only; never point hermetic tests at the production wallet.
Hosted runtime: use the production API origin only after the human has approved the device grant.

Rotation and revocation

Issue a replacement, verify the replacement works with a free get_wallet read, then revoke the old key. Never print either key while checking the replacement. If a secret may have leaked, revoke first and investigate second.

The authentication reference explains sign-in, agent access and scopes. The transports reference explains HTTP and MCP.