> ## Documentation Index
> Fetch the complete documentation index at: https://docs.webdock.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Keep browser sessions, OAuth tokens and Mail API keys separate.

## Protocol addresses

| Surface | Address |
| - | - |
| Browser Console | `https://console.webdock.dev` |
| OAuth issuer | `https://auth.webdock.dev/api/auth` |
| Registry and MCP resource | `https://studio.webdock.dev/api/mcp` |
| Registry REST base | `https://studio.webdock.dev/api/registry` |
| Mail REST base | `https://api.webdock.dev/api/mail/v1` |

The Mail API uses `api.webdock.dev`; `https://auth.webdock.dev/api/mail/v1` remains a compatible alias for existing clients. Both hosts use the same keys, quotas and idempotency state, without redirecting requests.

The browser moved to Console. Registered OAuth callbacks, the MCP resource audience and legacy bearer API addresses remain protocol identities. Do not substitute the Console hostname in token requests.

## OAuth clients

Register a client in [Connections](https://auth.webdock.dev/connections). Use the exact callback URL supplied by your client. Public/native clients use PKCE without a secret; confidential server clients can use a client secret. Dynamic anonymous registration is disabled.

Consent and granted scopes limit the token. The server also checks current session, account and resource permissions. Disabling the client or signing out can invalidate access before nominal token expiry.

Clients explicitly enabled for remote renewal can request `offline_access`. Store refresh tokens in the client's credential store, serialize renewal, and replace a token after rotation. Reconnect when the session or refresh grant expires.

## Mail keys

Mail uses its own bearer keys, created for a workspace and connection. `sending_access` supports sending; `full_access` permits the broader Mail API subject to resource restrictions. Restrict the sender domain where possible. A provider credential is not a Webdock Mail API key.

<Warning>Never place a Mail key, OAuth client secret or private CMS bridge credential in browser code, a public repository or a documentation example.</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.