Configuration should make the safe path easy: one API endpoint, one secret and one explicit account context.

## Endpoint

The hosted API is rooted at `https://api.scrollport.com/v1`. The public web app is at `https://scrollport.com`. Keep these origins distinct; a browser page and an agent key have different trust boundaries.

## Credentials

The CLI writes its key to `~/.scrollport/credentials.json` with mode `0600`. A hosted runtime should use its platform secret manager. Inject the key at process start, read it from the authorization header at request time and never echo it.

```http
Authorization: Bearer sp_live_<secret>
```

Keys are scoped to an account. A key is the noun in usage and wallet records; it is not an “agent” grouping that can hide which machine or harness spent money.

## Environment-specific checks

- Local development: use a dedicated test key and a local or explicitly configured API.
- CI: use test credentials only; never point hermetic tests at the production wallet.
- Hosted runtime: use the production API origin only after the human has approved the device grant.

## Rotation and revocation

Issue a replacement, verify the replacement works with a free `wallet` read, then revoke the old key. Keep the old key out of logs while you confirm the new prefix. If a secret may have leaked, revoke first and investigate second.

The [authentication reference](https://scrollport.com/docs/reference/authentication) records the planes and scopes. The [transports reference](https://scrollport.com/docs/reference/transports) explains HTTP and MCP.