# Authentication

A single Bearer API key authorizes every /v1 request. Never send two credentials.

## Single credential

The SeaChat Platform API uses exactly one credential: a bearer API key sent as `Authorization: Bearer <apiKey>`. SeaGate (the gateway) rejects requests that present more than one credential type, so do not also send `x-api-key`. The SDK is built to send only the one header.

Tenancy is user-scoped. Each key acts as a single user; there is no separate organization or project credential and no second token to manage.

```bash
import { SeaChat } from "@seachat/platform-sdk";

const client = new SeaChat({ apiKey: process.env.SEACHAT_API_KEY! });
const me = await client.me.get(); // GET /v1/me
console.log(me.subject, me.scopes);
```

## Headers and base URL

Send `Authorization: Bearer <apiKey>`. The base URL defaults to `https://seachat.ai`; override it with the `baseUrl` constructor option or the `SEACHAT_BASE_URL` environment variable (for example to point at a local gateway during development). All public paths are under `/v1`.

```bash
curl https://seachat.ai/v1/me \
  -H "Authorization: Bearer $SEACHAT_API_KEY"
```

## Scopes

Each route enforces a scope: `model:invoke` for chat/responses/multimodal, `usage:read` for usage, `files:write` / `files:read` and `seadb:content:read` / `seadb:content:write` for files and documents, `seatool:read` / `seatool:write` / `tool:invoke` for tools, and `seaplane:read` / `seaplane:write` for threads. Identity, key-management, and discovery routes need only a valid key.

Inspect what your key can do with `client.capabilities.list()` (`GET /v1/capabilities`).