Direct answer

Agents authenticate with a workspace API key sent as a Bearer token, or through MCP OAuth. A key carries call:tools to use read-only tools, plus call:write_tools if it may use tools that change something upstream, and it can be limited to specific sources.

API keys

  • Created in the dashboard, per workspace. The secret starts with spyn3_live_ and is shown once. SPYN3 keeps only its hash.
  • Sent as Authorization: Bearer spyn3_live_… on every request.
  • Revocable at any time; a revoked key stops working on its next request.
  • Free includes one key, Pro ten, Team unlimited.

Permissions

READcall:toolsList and open sources, and call tools that are known not to change anything.
WRITEcall:write_toolsAlso call tools that may send, create, update or delete upstream.

A tool counts as a write unless there is positive evidence otherwise: the upstream server marks it readOnlyHint, or SPYN3 generated it and knows it is read-only. A key without call:write_tools doesn't merely get refused when it calls a write tool. It never sees the tool at all.

Start read-only

Most agents only need to look. A key that can only read is a much smaller thing to leak, so add call:write_tools only to the key of an agent that is meant to act.

Source scope

A key can be limited to some of the workspace's sources. Sources outside its scope are absent from its folder list, its tool list and its routing, so the support agent's key never reaches the production database.

MCP OAuth

Clients that implement the MCP authorization spec need only the endpoint URL. The client fetches https://api.spyn3.com/.well-known/oauth-protected-resource, signs you in, and shows SPYN3's consent screen, where you choose the workspace and the scopes:

READspyn3:readEquivalent to call:tools.
WRITEspyn3:tools:writeEquivalent to call:write_tools.

Every client you have approved is listed in the dashboard and can be revoked there.

Upstream credentials

When you connect Notion, Linear or a database, SPYN3 stores that credential encrypted at rest with envelope encryption. It is never returned to the dashboard or to an agent. OAuth-connected sources refresh their tokens automatically, and disconnecting a source asks the provider to revoke the grant.

Isolation

Every row belongs to a workspace. The service layer filters on it explicitly, and Postgres row-level security enforces it again underneath. The credential determines the workspace, so an agent never names a tenant in a request. Cross-workspace isolation is tested on every commit.

Scope it once

Give each agent only what it needs

Create a read-only key for your first agent and widen it only when the agent has a reason to act.

Start free