Authentication and scopes - Factorize

Protected API and MCP requests use Authorization: Bearer <token>. Browser users may also use their signed Factorize session cookie. Access is tenant-bound; owner membership and session version are rechecked on every service call.

Scopes

Scope	Allows
`flows:read`	Jobs, targets, connections, integrations, trigger availability
`flows:write`	Create/update/delete/enable/disable jobs; test handlers
`runs:read`	List/get runs and webhook activity
`runs:write`	Invoke and stop runs

Authorization-code clients must use PKCE S256. Implicit and plain PKCE are disabled. Access tokens last 1 hour; refresh tokens can last 30 days. RFC 7009 revocation is advertised by discovery.

Device flow

Register a public client at POST /oauth/register with grant_types containing urn:ietf:params:oauth:grant-type:device_code and token_endpoint_auth_method: none.
POST form data to /oauth/device_authorization with client_id, scope, and optional resource.
Send the user to /device?user_code=... and poll /oauth/token with the device code.

Device codes expire after 10 minutes and polling is rate limited. The token endpoint returns authorization_pending, slow_down, access_denied, or expired_token as appropriate. Never send Linear, exe.dev, or connection credentials to an API client. Tokens are revocable and responses omit stored secrets.