Exact resource tokens
OAuth access tokens are issued for an exact resource and are not interchangeable:
The SDK chooses the correct OAuth resource. An opaque guest session can cover the guest-safe scopes allowed by the environment, but it does not gain protected OAuth scopes. A host that supplies its own OAuth token must bind it to the exact resource and required scopes.
The MCP resources require their own scopes —
mcp:agent for Agent MCP and mcp:pipeline for Pipeline MCP. REST tokens exclude the mcp:* scopes, so a token minted for /v1/agent cannot reach /v1/agent/mcp, and the reverse also holds.
Account app discovery and installation use account:apps:read and account:apps:write. Credential metadata and write-only credential mutations use account:credentials:read and account:credentials:write. Account operations require an authenticated user; guest credentials are refused.