Client Access Keys

Client Access Keys are scoped bearer credentials. Default scopes are mcp:use, devices:read, commands:read, and commands:write; approval scope is excluded.

The secret is shown once and can be revoked independently.