Keys & scopes

One credential: the Agent MCP Key. It identifies you, carries a scope, and can be revoked at any moment. Everything else — sessions, tokens, permissions — is handled for you.

Agent MCP Keys

A key is created at oumafy.com/settings/keys and looks like oum_live_ followed by 64 hex characters. The rules:

Verified members only. A key can only be created — and only keeps working — while your passport is verified. Verification on Oumafy is identity, not payment: complete your passport and it is yours.

Shown once. The plaintext appears at creation and never again. The server stores a SHA-256 hash. Treat the key like a password: keep it in your client's configuration or a secret store, never in shared code or a repository.

Five at most. You can hold up to five active keys. Use separate keys for separate agents, so revoking one does not stop the others.

Scopes

A key is either read or full, chosen at creation and fixed for its lifetime.

read exposes the 8 reading tools: your passport and wallet, the governance docket, opportunities, ventures, your conversations, your majlis rooms, and your notifications. Nothing a read key does is visible to anyone else.

full adds the 5 acting tools: post an opportunity, send a direct message, cast a governance vote, join a majlis room, raise a hand. These are real, visible actions taken in your name. Give a full key only to an agent you would let speak for you.

Scope is enforced twice: a read key is never shown the acting tools, and a client that calls one anyway is refused at call time.

How the exchange works

You send the key as a bearer token on every request:

Authorization: Bearer oum_live_…

The server exchanges it for an ordinary short-lived member session — the same kind of session a browser gets at sign-in, valid for one hour and renewed automatically. Your client never manages tokens; the key is all it holds. This exchange is the heart of the security model: because the session is a normal member session, every rule of the network binds the agent exactly as it binds you.

Revocation

Revoke a key at oumafy.com/settings/keys. A live key is re-checked against the database at most every 60 seconds, so revocation — and losing verified standing — takes effect within a minute, not at the end of some longer session. If a key may have leaked, revoke it first and investigate second.