> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nimt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and access

> Choose how to connect and understand what a connection can access.

Both authentication methods act as your Nimt user. Neither expands your
workspace membership or grants platform administration access.

|                     | OAuth                                         | Personal access token (PAT)                              |
| ------------------- | --------------------------------------------- | -------------------------------------------------------- |
| Best fit            | Interactive clients with browser sign-in      | Clients with bearer-token support or non-interactive use |
| Workspace           | Selected when you approve the connection      | Your active workspace when you create the token          |
| Credential handling | Managed by your client                        | Stored and supplied by you                               |
| Remove access       | Disconnect the approval in **Connected apps** | Revoke the token in **Personal access tokens**           |

## Workspace boundaries

A connection is tied to one workspace. It can discover projects there and use
project-scoped tools only for projects belonging to that workspace. Knowing a
project ID from a different workspace does not give the connection access to it.

Switching workspaces in the Nimt app does not retarget an existing connection.
To use another workspace, approve a separate OAuth connection or create a token
while that workspace is active. If your client supports multiple server entries,
give them distinct names so you can tell them apart.

Nimt checks your current membership on requests. If you lose access to the
workspace or your account is disabled, the credential no longer authorizes MCP
access there.

## Permissions

| Scope            | Meaning                                                                                                                  |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `mcp:read`       | Allows read tools. Required to connect to the current MCP.                                                               |
| `mcp:write`      | A permission for write operations within your existing access. There are no write tools in the current customer catalog. |
| `offline_access` | OAuth only: allows the client to refresh its connection without asking you to sign in for every access token.            |

OAuth clients request scopes, which appear on the consent screen. They may also
request the standard `openid`, `profile`, and `email` scopes for account identity
and profile information. Review every permission before approving.

<Note>
  PATs created in Nimt currently include both `mcp:read` and `mcp:write`; the
  creation form does not offer a read-only option. OAuth may also request both.
  The current tools are read-only, but a credential with write permission is not
  a read-only credential. Revisit your approvals as the pre-release catalog
  evolves.
</Note>

A permission does not create a tool or bypass the workspace checks. Your
client's approval prompts are an additional control; they do not replace Nimt's
authorization.

<CardGroup cols={2}>
  <Card title="Connect with OAuth" icon="arrow-right-to-bracket" href="/mcp/authentication/oauth">
    Sign in, choose a workspace, and manage connected apps.
  </Card>

  <Card title="Use a personal access token" icon="key" href="/mcp/authentication/personal-access-tokens">
    Create, store, and revoke a token.
  </Card>
</CardGroup>