# Authentication

Create a token in the app under **Developers**. Send it on every request:

```
Authorization: Bearer rmsu_...
```

The same token works for REST and MCP. It is shown once; we store only a fingerprint. Revoking a token stops it immediately.

## Scopes

| Token | Can do |
|---|---|
| **Read only** (default) | Look at everything in the workspace. Safe to hand to an agent. |
| **Read and write** | Also add domains and checks, pause and resume, run a check now, create heartbeats, maintenance windows and deploy markers. |
| **Limited to one domain** (either of the above) | Sees and touches only that domain. It cannot add new domains. |

Even a write token cannot: delete incident history, change alert channels, create other tokens, or reach billing. Alert channels are listed by name only; secrets are never returned. A read-only token also never sees a heartbeat's ping URL, because that URL can report "all fine".

## Limits

- 120 requests per minute per token (`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`; HTTP 429 with `Retry-After`).
- 200 changes per hour per token.
- Your plan's own limits (domains, checks, fastest interval) apply to the API exactly as to the app.

Every change made with a token is recorded and shown under Developers ("What tokens changed lately").