# Authentication

Canonical URL: https://doc.roote.ai/authentication



ROOTE developer access is managed at [dev.roote.ai](https://dev.roote.ai).

## One developer token [#one-developer-token]

The target access model uses one ROOTE developer token across the REST API and authenticated ROOTE MCP access.

### Bearer authentication [#bearer-authentication]

Use Bearer authentication for persistent integrations:

```http
Authorization: Bearer YOUR_API_TOKEN
```

### Query-token authentication [#query-token-authentication]

API endpoints that explicitly support query authentication accept:

```text
?token=YOUR_API_TOKEN
```

Query-token authentication is not inherently invalid. Complete URLs may be retained in history, logs, analytics, referrers, screenshots, or copied links. Prefer Bearer for persistent integrations and use query tokens only where the endpoint contract and exposure model are appropriate.

## Scopes [#scopes]

| Scope            | Access                                                    |
| ---------------- | --------------------------------------------------------- |
| `geography:read` | Geography capabilities such as geocoding and place search |
| `mobility:read`  | Shared mobility and urban-service capabilities            |

## MCP authentication state [#mcp-authentication-state]

The target MCP model uses the same ROOTE developer token:

```http
Authorization: Bearer YOUR_API_TOKEN
```

<Callout title="Current deployment" type="warn">
  The currently deployed public MCP server may still accept unauthenticated clients until token enforcement is deployed. OAuth is not required by the current public setup.
</Callout>

See [API Authentication](/roote-api/api-authentication) and [Connect ROOTE MCP](/roote-mcp/connect-roote-mcp).