Agent credentials and reauthorisation

Reauthorise after the durable cutover

All legacy agent credentials, OAuth grants and tokens, and pending authorization requests are revoked during cutover. Remove the old MCP server entry, add https://api.txcast.com/mcp/v2, and complete consent again. Do not paste an old txc_ or txo_ token into the v2 client.

Recommended: OAuth for MCP

When the MCP host opens txcast consent:

verify the client ID and callback host;
choose selected organisations when practical;
grant only the needed v2 scopes;
select the exact controlled accounts the workflow may reference;
choose a short expiry and approve.

The dedicated credential appears under Profile → API keys. OAuth access tokens are short lived and refresh tokens rotate. Revoking the credential invalidates its entire token family.

Manual API key

Use a manual key for REST or a bearer-only MCP host:

Open Profile → API keys and create a new key.
Select organisations, v2 scopes, controlled-account access, and expiry.
Copy the one-time txc_… secret into a password manager or environment variable.

txcast stores only token hashes. A secret cannot be recovered.

Relevant durable scopes

organisation.read: context, registry, workflow, run, and effect reads.
workflow.source.write: validate, create, save, restore, and fork workflows.
run.start: create and start a run atomically.
run.cancel: cancel future run coordination.
run.source.refresh: append a current EVM/HTTP source observation.

The cutover removes obsolete workflow-authoring scopes. The workflow.source.write scope does not grant run-start, human-response, signing, or broadcast authority.

Controlled-account grants

A finite selected grant is preferred. Durable source validation, creation, saving, restoration, forking, and run creation compare the proposed or resolved capability set with that exact grant. A finite grant rejects unrestricted account capability bindings.

Scopes and grants are ceilings, not role grants. Live organisation membership, seat, ownership, and role can further restrict them. To widen authority, create a replacement credential, verify the client, then revoke the old credential.