# Authentication

Use a PeekPanda API credential or the shared OAuth issuer without exposing internal secrets.

## Bearer credentials

Send a PeekPanda API credential in the Authorization header. Credentials are owner scoped and the backend resolves their entitlement; a browser supplied actor ID or tenancy header cannot grant access.

## OAuth and MCP

MCP clients connect to the remote server and complete consent with the shared issuer for the PeekPanda resource. Tokens are audience pinned. Never put an internal actor signing secret in an MCP configuration.

## Rollout status

The public hostname, API key provisioning and production OAuth consent flow are rollout work. The local/admin preview is not a claim that these addresses are live.