Configuration should make the safe path easy: one API endpoint, one secret and one explicit account context.
Endpoint
The hosted API is rooted at https://api.scrollport.com/v1. The public web app is at https://scrollport.com. Keep these origins distinct; a browser page and an agent key have different trust boundaries.
Credentials
The CLI writes its key to ~/.scrollport/credentials.json with mode 0600. A hosted runtime should use its platform secret manager. Inject the key at process start, read it from the authorization header at request time and never echo it.
Authorization: Bearer sp_live_<secret>Keys are scoped to an account. A key is the noun in usage and wallet records; it is not an “agent” grouping that can hide which machine or harness spent money.
Environment-specific checks
- Local development: use a dedicated test key and a local or explicitly configured API.
- CI: use test credentials only; never point hermetic tests at the production wallet.
- Hosted runtime: use the production API origin only after the human has approved the device grant.
Rotation and revocation
Issue a replacement, verify the replacement works with a free wallet read, then revoke the old key. Keep the old key out of logs while you confirm the new prefix. If a secret may have leaked, revoke first and investigate second.
The authentication reference records the planes and scopes. The transports reference explains HTTP and MCP.