> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bibleit.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bibleit.dev/_mcp/server.

# Authentication

> Choose the credential for the resource ownership boundary.

| Credential                     | Use                                                     | Lifecycle                                                                  |
| ------------------------------ | ------------------------------------------------------- | -------------------------------------------------------------------------- |
| Personal API token, `bt_`      | Own identity/account, reading and personal Reader Lives | Finite lifetime; current personal authority and token scope rules apply    |
| Delegated access token, `oa_`  | Registered client's consented personal access           | At most 15 minutes; explicit grant scopes and current owner authority      |
| Delegated refresh token, `or_` | Refresh a registered personal OAuth grant               | Single-use rotation within a fixed 30-day grant; never a REST bearer token |
| Browser session                | Browser forms and OAuth consent                         | Not accepted as REST bearer authentication                                 |

Organization backends use scoped `svc_` service tokens. Their creation, rotation,
permissions and workspace examples are in the
[Organizations section](/api-reference/organizations/quickstart).

REST requests send `Authorization: Bearer <token>`. Service tokens cannot become
personal accounts or browser sessions. Personal and delegated
tokens cannot manage organization membership, Studio settings, presentations or
workspace moves. Tokens never bypass current ownership, organization status,
processing policy or quotas. Realtime delivery rechecks the credential after waits.

For delegated personal access, register a public client with an operator. Use
Authorization Code with S256 PKCE, an exact registered redirect URI, random state
and explicit browser consent. Discover protocol URLs at
`https://bibleit.app/.well-known/oauth-authorization-server`. OAuth endpoints live
on `https://bibleit.app/oauth`, outside the REST API hostname; consent uses a browser session.

Validate redirect state and issuer, exchange the single-use code with its original
PKCE verifier, and store rotating tokens atomically. `offline_access` enables
refresh tokens. Code or refresh replay revokes the grant family: never retry an
ambiguous exchange as though it were an idempotent resource creation. There is no
implicit grant, password grant, client-credentials grant, dynamic registration or
OIDC profile in this initial implementation.

A person can inspect and revoke connected clients at `/settings/connected-apps`
and through their authenticated grant-management resources. Client applications
must obtain new consent after revocation or grant expiry.

Use the [authorization endpoint](/api-reference/o-auth/authorize-o-auth) and
[token exchange](/api-reference/o-auth/exchange-o-auth-token) reference for
request fields and PKCE requirements. Operator registration instructions remain
in the repository at `docs/reference/oauth.md`.