Authentication and scopes
Credentials determine identity, authorization and funding; they are not interchangeable.
| Credential | Auth | Funding / purpose |
|---|---|---|
Personal PAYG sk-acm-… | Authorization: Bearer on /api/open/v1/* | Open API Credits pool 3; issued from the console |
| Member OAuth access token | Client.create/login, consented OAuth scopes | Member/business APIs; the SDK defaults to /api/v4 and /admin-api for compliance |
| Member delegated Key | BASIC scope and separate issuance/invocation gates | Member funds and quota; not pool 3 |
| Java Web session | Console and order queries | Own-account queries; not an execution scope substitute |
Static Keys may not receive agent_access:manage. A generic JWT must not substitute for compliance execution authorization. The SDK declares 15 compliance scopes; the current OAuth registry has 19 including those 15. Static-Key issuance has its own set and risk tiers. Different counts are expected; verify set inclusion/exclusion and issuer authority. COMPLETED screening does not prove enterprise approval; enterprise Keys stay gated until their funding contract is accepted.
The console selects only scopes with ready=true in /api/open/v1/capabilities. The specific model/profile also needs catalog and price readiness. Issuance, credential validity, execution, price readiness and business acceptance are separate evidence.
Console balances and bills require a Java Web session; the Nexus login JWT used by PAYG Key management is a separate credential. The console proxy verifies the principal and tenant in both services. If accounts differ, sign out and authenticate again instead of substituting a token. Enterprise Keys require your approved enterpriseId. Unproven historical numeric identities require manual review and cannot establish order or OWNER rights.