> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dexi.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> MCP OAuth connections and personal API tokens

Dexi has two credential kinds, for two different jobs.

## MCP connections (OAuth)

MCP clients never handle long-lived secrets. When a client first connects to `https://mcp.dexi.net/mcp`, it registers itself, opens your browser to a Dexi consent page, and receives short-lived tokens after you approve — the standard OAuth 2.1 flow, handled automatically by the client.

Two scopes exist, and the consent page shows exactly what a client requested:

| Scope         | Grants                         |
| ------------- | ------------------------------ |
| `notes:read`  | Search and read your notes     |
| `notes:write` | Create, edit, and delete notes |

Beyond scopes, the consent page lets you restrict a connection to notes in one folder, one tag, or both — see [access restrictions](/mcp/oauth#access-restrictions).

Review and disconnect clients any time in **Settings → Connected apps** — revoking kills the client's access immediately, and **Edit access** changes a connection's boundary live. Protocol details for client builders are on the [OAuth page](/mcp/oauth).

## Personal API tokens

Tokens are minted in [Settings → API tokens](https://app.dexi.net/dashboard/settings): 44 characters starting with `dxi_`, shown **once** at creation and stored hashed — copy it then or mint a new one. Up to 10 active tokens; revoke any of them from the same screen.

```bash theme={null}
curl -X POST https://api.dexi.net/api/v1/bookmarks/save \
  -H "Authorization: Bearer dxi_2f7c1a9e4b8d3f6a0c5e9b2d7f4a8c1e3b6d9f2a" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/article"}'
```

A token authenticates **exactly one endpoint**: [`POST /api/v1/bookmarks/save`](/api/save-bookmark). That's deliberate — tokens live in Shortcuts, scripts, and other places that leak, so a leaked token can add pages to your workspace but can never read, change, or delete anything in it. Full data access belongs to MCP connections, which you approve and revoke individually.

Everything else under `api.dexi.net` is the Dexi app's own session-authenticated API and isn't usable with tokens.