# Lux API: signing in

Every call takes one header: `Authorization: Bearer <credential>`. The credential is an API key (`sk-live-…`) or an access token from Lux's identity server, https://lux.id. That server runs every sign-in and mints every token; this API validates them and holds no password.

The whole recipe, every body included: https://lux.network/llms.txt

## A terminal or a device with no browser

OAuth device authorization (RFC 8628): `POST https://lux.id/v1/iam/oauth/device` answers a code and a page; a person opens the page and enters the code while the device polls `POST https://lux.id/v1/iam/oauth/token` with `grant_type=urn:ietf:params:oauth:grant-type:device_code`.

## A person

Create and revoke API keys at https://console.lux.cloud/api-keys.

## An app

OpenID Connect against https://lux.id: the authorization code flow with PKCE (`S256`). Metadata: https://lux.id/.well-known/openid-configuration.

## Scopes

`openid`, `profile`, `email`, `offline_access`. What a token may do is decided by its own user and organizations.

## Discovery

- Protected resource metadata (RFC 9728): https://api.lux.network/.well-known/oauth-protected-resource
- Authorization server metadata (RFC 8414): https://lux.id/.well-known/oauth-authorization-server
- MCP: `POST https://api.lux.network/v1/mcp` answers a tool call that carries no credential with 401 and a `WWW-Authenticate` header naming the resource metadata.