Authentication

Mitosis has a deliberately small auth surface: public read endpoints take no credential at all, and everything that touches a person's memory takes a bearer token or an OAuth grant.

What needs a credential

Surface	Credential
/api/v1 read endpoints	None
MCP public tools (get_pricing, get_platform_status, search_docs, list_skills)	None
MCP memory tools (cortex_*)	OAuth 2.1 grant, scope memory:read or memory:write
SDK / CLI office operations	API key or device-code session
Backups API	Bearer token, scopes backups:read / backups:write / backups:admin

OAuth 2.1 for MCP clients

The MCP server supports dynamic client registration, so an MCP client does not need a pre-registered client_id. Point it at the server and it discovers everything it needs:

curl -s https://mitosislabs.ai/.well-known/oauth-authorization-server | jq
curl -s https://mitosislabs.ai/.well-known/oauth-protected-resource | jq

The first is RFC 8414 metadata (and carries an agent_auth block describing agent registration); the second is RFC 9728 protected-resource metadata. The user approves access in a browser, and the client receives a token scoped to their memory.

Memory tools declare the scope they need. Reads (cortex_ask, cortex_recall, cortex_manifest, cortex_status, cortex_connectable_sources, cortex_connect_link) need memory:read. Writes (cortex_remember, cortex_ingest_conversation) need memory:write.

Device-code login (CLI)

For humans at a terminal, the CLI runs a device-code flow: it prints a URL, you approve in the browser, and the session is stored locally.

npm install -g @mitosislabs/sdk
mi login
mi whoami

API keys (scripts and servers)

Copy a key from the dashboard user menu (keys are prefixed mi_) and pass it as an environment variable. The SDK and CLI both read MI_API_KEY:

export MI_API_KEY="mi_..."
mi offices list

In code, endpoint is required alongside the key:

import { MitosisClient } from '@mitosislabs/sdk';

const client = new MitosisClient({
  endpoint: 'https://m.mitosislabs.ai',
  apiKey: process.env.MI_API_KEY,
});

Or let the SDK read whatever mi login already stored in ~/.os1/config.json:

const client = await MitosisClient.fromConfig();

Bearer tokens over HTTP

header is the only bearer method the protected-resource metadata advertises, so tokens in query strings are not accepted:

GET https://mitosislabs.ai/api/snapshots
Authorization: Bearer <token>

Machine-readable version

/auth.md carries the same instructions in the workos/auth.md convention, for agents that discover and register on their own.