Choose Credentials

Choose Platform, Classic, or Scribe credentials, confirm the tenant and host, and verify access before starting a workflow or installing a client.

For a new Platform integration, start with your assigned workspace, regional API base, and a credential accepted by the operation you need. Keep the API family and base URL alongside the tenant identifier in your integration configuration.

Choose the Access Boundary

Your task	Tenant and caller	Credential and owning guide
Read or configure Platform workspace resources from a trusted server	One workspace; permissions of the key or token	Platform workspace keys on routes that accept them
Run a scoped backend integration	Workspace and scopes granted to the client	OAuth2 machine-to-machine
Use managed channels with your own agent or backend	Provisioned setups and granted channel operations	Standalone Channel Manager OAuth on its separately assigned host
Sign in interactively to a CLI or desktop application	Signed-in identity and selected workspace	Device authorization
Create or review clinical documentation	Provider principal, owning provider, and matching workspace	Scribe provider access, with the scope required by the operation
Maintain a Classic integration	Organization and authenticated user	Classic key-to-token exchange, then a Classic SDK or HTTP client
Query Classic data through the standalone Data-MCP service	Classic organization and user	Data-MCP

API keys, identity tokens, provider tokens, and channel-management credentials have different access boundaries. Similar route names do not make their hosts or authorization rules interchangeable. For browser applications, follow Serve an Agent From a Web App; keep long-lived workspace credentials on the trusted server.

Verify Platform Access

1. Obtain your workspace ID, assigned regional endpoint, and the required read permission from the implementation owner.
2. Configure the Platform SDK, or use the workspace-key HTTP example in Authentication & API Keys.
3. Run the read-only SDK quickstart. Confirm the returned workspace matches the intended test deployment.
4. Select an explicitly configured test service before running First Verified Conversation.

A successful read verifies access to that resource. It does not verify channel provisioning, tool permissions, provider enrollment, or external delivery.

Diagnose Access Failures

Check the API family, host, tenant identifier, credential expiry, and required scope or permission before repeating a request. Use the route's documented error response to distinguish authentication failure from insufficient access or an unavailable resource. Preserve the correlation identifier when one is supplied, and use Troubleshooting to identify the next diagnostic.

Sessions Mean Different Things

Session	Purpose	Continue here
Identity session	Login, token validity, and account access	Platform authentication
Persistent text session	Connection and interaction protocol	Platform Sessions
Scribe session	Provider-owned clinical encounter and artifacts	Scribe Sessions

Ending a conversation, disconnecting a socket, finalizing a clinical note, and revoking a login are different operations.