OAuth and connected apps

MCP clients (Claude Code, Codex, Cursor, VS Code, claude.ai) and the Scalaix CLI don't use API keys to manage your account. They sign in with OAuth: the app opens Scalaix in your browser, you approve what it may do, and it gets a token that works only for that.

API keys (sx_…) are still what your application uses to call the gateway and your published endpoints. OAuth tokens can't call them, and API keys can't manage your account.

Approving an app

The consent screen shows the app's name and where your browser goes back to afterwards (for example localhost:43117 for a CLI, or claude.ai). Scalaix doesn't verify apps: only approve ones you started yourself.

You choose:

• Team. The app works in one team. To use another team, connect again.
• Projects. All projects includes projects created later, and lets the app create projects. Only these projects limits it to the ones you tick; it can't see or create others.
• Permissions, below. You can untick any of them except reading projects.

Deny sends the app back with an access_denied error and shares nothing.

On a machine without a browser, scalaix login --device shows a code like BCDF-GHJK: open www.scalaix.com/device anywhere, sign in, enter the code, and check it matches before you approve.

Permissions

Scope	Shown as	Allows
projects:read	Read your projects	Projects, collections, endpoints, versions, docs and models; generating integration code. Always included.
projects:write	Build and test endpoints	Creating and changing projects, collections and endpoints, drafting endpoints, test runs, test environments and saved cases. Drafts and test runs use credits.
publish	Publish versions	Publishing a collection version, which changes your live API for callers that don't pin a version.
keys	Manage API keys	Listing, creating and revoking keys and editing their rules. A new key is visible to the app. Only asked for when the app needs it.
usage:read	Read usage and logs	Usage reports, request logs and the team's credit usage.

A tool or command that needs a permission you didn't allow fails with a message naming the scope. Connect again and leave it ticked.

Tokens

• Access tokens (sxo_…) last an hour. Refresh tokens (sxr_…) last 90 days from their last use and are replaced every time they're used; using an old one again disconnects the app, which protects you if one is copied.
• Scalaix stores only hashes of tokens.
• Tokens work on the console API only, inside the team, projects and permissions you approved.

Connected apps

In the console, open the account menu (bottom left) and choose Connected apps. Each app shows its team, projects, permissions, when you connected it and when it was last used. Disconnect signs it out right away, on every device that used that approval. API keys it created keep working until you revoke them on the project's Keys page.

scalaix logout disconnects the CLI the same way.