Use this page when configuring a client yourself. For guided setup, give your agent the setup prompt.
Endpoint
The hosted API is rooted at https://api.scrollport.com/v1. The public web app is at https://scrollport.com. Send authenticated API requests to the API endpoint, not the website.
Credentials
The CLI writes its key to ~/.scrollport/credentials.json with mode 0600. A hosted runtime should use its platform secret manager. Inject the key at process start, send it in the Authorization header and never echo it.
Authorization: Bearer sp_live_<secret>Each key grants access to one workspace. Give each agent its own key so you can review its activity and revoke it separately.
Environment-specific checks
- Local development: use a dedicated test key and a local or explicitly configured API.
- CI: use test credentials only; never point hermetic tests at the production wallet.
- Hosted runtime: use the production API origin only after the human has approved the device grant.
Rotation and revocation
Issue a replacement, verify the replacement works with a free get_wallet read, then revoke the old key. Never print either key while checking the replacement. If a secret may have leaked, revoke first and investigate second.
The authentication reference explains sign-in, agent access and scopes. The transports reference explains HTTP and MCP.