Scoped access without shared passwords

Use Authorization: Bearer txt_… for server integrations, CLI, SDK, and MCP. Account owners create keys at /sync, choose named read/write scopes, and may set an expiry. The raw credential is shown once, hashed at rest, and can be rotated or revoked without changing the account.

First-party clients may use dots OAuth Authorization Code with PKCE. Discover the actual authorization server through RFC 9728 protected-resource metadata; the authorization server publishes its RFC 8414/OpenID metadata. Never send a bearer credential in a URL or allow it to cross an origin redirect.

curl -H "Authorization: Bearer $TXT_API_KEY" \
  https://www.txt-fil.es/api/v1/files

A 401 response means the credential is missing, invalid, or expired. A 403 response names the missing scope. Create a narrower replacement rather than broadening every integration.