> For the complete documentation index, see [llms.txt](https://k-ai.gitbook.io/knowledge-ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://k-ai.gitbook.io/knowledge-ai/get-started/choose-your-auth.md).

# Choose your auth

Three auth surfaces — organization API keys, OAuth 2.1, and cookies; pick by caller type.

| Caller type                                                                                                                                     | Auth                                                          | Documentation                                                                  | Next step                                                                                |
| ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- |
| Backend automating organization, audit, or retrieval workflows with a role                                                                      | Organization API key → Bearer JWT                             | [Organization API keys](/knowledge-ai/authentication/organization-api-keys.md) | Create a key in the K-AI Studio portal, then exchange it                                 |
| Autonomous agent platform driving MCP with no human in the loop                                                                                 | Organization API key sent directly in `Authorization: Bearer` | [Autonomous agents (API key)](/knowledge-ai/k-ai-mcp/autonomous-agents.md)     | Create a key, add it to a retrieval group, point the agent at `/mcp`                     |
| MCP client (Claude Desktop / Cursor / Le Chat) or custom user-level integration spanning multiple instances                                     | OAuth 2.1 (Bearer JWT)                                        | [OAuth 2.1](/knowledge-ai/authentication/oauth.md)                             | [Quickstart — K-AI MCP](/knowledge-ai/get-started/mcp-quickstart.md) (first MCP install) |
| Browser frontend on `.kai-studio.ai` (K-AI Audit web app, K-AI Studio portal, K-AI Retrieval admin console, K-AI Consumption Monitoring System) | `kai_auth` HttpOnly cookie                                    | [Cookies](/knowledge-ai/authentication/cookies.md)                             | [K-AI Audit web app](https://app.kai-studio.ai) (sign in directly)                       |

## Decision rules

* **Use Organization API keys** when a backend automates organization, audit, or retrieval workflows and needs a role. The key authenticates as a service account; the token it mints is authorized by organization RBAC, exactly like a portal user.
* **Send an Organization API key directly** — raw, in `Authorization: Bearer`, with no exchange step — when the caller is an unattended agent platform talking to the Audit or Retrieval APIs or their MCP endpoints. OAuth needs a human at a consent screen; an autonomous agent has none. Authorization is unchanged: the key is authorized by the same organization RBAC as any other identity.
* **Use OAuth 2.1** when the caller acts on behalf of a human user, especially for interactive MCP clients and cross-instance queries. Tokens are scoped to the user's access rights.
* **Use cookies** only for browser frontends served from `*.kai-studio.ai`. Never read/write the cookie from JavaScript — it's HttpOnly by design.