# Authentication

Talarion has two ways to authenticate, depending on how you connect. Both are scoped to a
**workspace**, which owns usage and billing.

## OAuth (MCP clients)

The default for MCP-capable clients, namely AI assistants like Claude and ChatGPT. On first connection the client registers itself automatically (Dynamic Client
Registration) and sends you to **[dashboard.talarion.com](https://dashboard.talarion.com)** to sign
in and choose a workspace. The client receives a short-lived token bound to that workspace and
refreshes it silently from then on. See [Install](/installation) for the per-client setup.

## API keys (REST API & non-OAuth clients)

For the [REST API](/rest-api) and for MCP clients that don't implement OAuth (for example,
OpenClaw), authenticate with a workspace API key.

1. Go to **[dashboard.talarion.com](https://dashboard.talarion.com) → API Keys → Create key** and
   copy the key — it's shown only once.
2. Send it as a bearer token on every request:

```
Authorization: Bearer tlrn_...
```

Keys are workspace-scoped and prefixed `tlrn_`. The same key works for the REST API and as the
bearer token in an MCP client's configuration. You can create and revoke keys anytime from the
dashboard.