Auth

Anonymous for light use: send sealed `X-Duan-Client-Id` or keep `duan_anon`; session for the web app; API keys for agents. Never paste secrets into chat.

• Anonymous — light create within rate limits. Store/resend sealed `X-Duan-Client-Id` (agents) or HttpOnly `duan_anon` (browsers). Not an account.
• Session cookie (`duan_session`) — web dashboard
• `Authorization: Bearer` — scoped API key from the dashboard. Idempotency scopes to `api_key_id` / user.
• OAuth access token — Authorization: Bearer after the browser consent. MCP tools only, not REST /v1. Public client, PKCE S256. An omitted scope is links:read only.
• OAuth is authorization code with PKCE S256 for public clients (no client secret). Grants: authorization_code and refresh_token. POST /oauth/register, GET /oauth/authorize, approve in the browser, then POST /oauth/token. Discovery: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. The A2A Agent Card is /.well-known/agent-card.json. It is static discovery and is not an A2A message endpoint. Access tokens last 1 hour. A refresh returns the same refresh token, extends its expiry by 30 days from that refresh, and never past 365 days from the grant. POST /oauth/revoke revokes an access token or a refresh token. No implicit grant, client-credentials grant, device code, or introspection.
• Issuable OAuth scopes: links:create, links:read, links:update, batches:create. links:disable and analytics:read are not issued. If no scope is requested, the token is granted links:read only. A token request may narrow that grant and cannot widen it.

Never paste API secrets into chat.

Machine discovery: `GET /v1/capabilities` (OpenAPI 1.6.2).