Access and consent

People sign in with Apple or Google; agents can sign in with AgentID using their own identities. The website and iOS app also support X after you connect it to your existing account through Connected accounts. First-time X sign-in asks you to sign in with Apple, Google, or AgentID and confirm the link. Connecting your identity keeps your existing Notify ownership. Connecting a Clerk identity preserves the original Notify account ID and its devices, notifications, apps, teams, and credentials. A matching email alone does not transfer ownership. If prompted to connect your original account, sign in with the Apple or Google account you previously used for Notify, inspect the displayed original account, and explicitly confirm the link. Accounts already bound to different identities cannot be merged through this flow.

An expired or replaced human session requires signing in again; the browser does not substitute an older account cookie for a missing Clerk session. If account linking is required, complete the recovery step before retrying the operation. Agent keys and OAuth access tokens authorize scoped API work, not human sign-in or account linking. An expired or revoked agent credential returns 401; reauthorize or replace it. A 403 permission error requires reviewing scopes, not retrying with the same insufficient grant.

Agent HTTP and MCP requests accept Authorization: Bearer with a scoped Notify user API key. Existing ntf_ keys remain compatible. Where Clerk is configured and your account is linked, newly issued keys use the ak_ prefix. Create these user keys through Dashboard → API keys, or use CLI device authorization; a key created outside Notify does not automatically carry Notify ownership or permissions. Missing route scopes return 403 with a required list. Resource access is constrained to the token’s account and permitted shared resources; foreign resource IDs return 404.

For a server integration, choose Create API key, give it a recognizable name, and review its scopes and expiry. The Server integration preset grants notifications:send, interactions:create, and services:write; the default expiry is 90 days. Copy the secret when it appears and save it in your server’s secret store: it is shown only once. Revoke a key from API keys when the integration no longer needs access.

For terminal use, notify auth login remains the browser authorization flow. MCP clients can use OAuth or a scoped API-key Bearer header at https://notify.belweave.ai/mcp. Browser-authorized CLI and OAuth connections do not require you to copy a dashboard key. Existing keys retain their own permissions, expiry, and revocation state; a new Clerk-managed key uses the expiry selected when it is issued, rather than inheriting another key’s lifetime.

• The default CLI login requests all agent scopes except events:read and tokens:manage. Explicit --scope flags replace the default scope set; repeat the flag for each permission you need.
• Older/narrower connections may lack device, inbox, billing, team, on-call, or connector scopes. Compare auth status with the reference’s route requirements and reauthorize only what you need.
• Agent service list/get omit webhook URLs. Create/rotate reveal the URL once; signed-in dashboard access is separate.

A scoped connection can perform supported operational work, but it cannot make these identity or consent decisions. Use the signed-in website or native client for account consent, including an AgentID account consenting for itself. Decisions addressed to a person still require that person’s answer:

• Answer a question: only a human may approve, deny, choose yes/no, or submit a reply. Agents can read and cancel.
• Create API tokens: minting a broader token would defeat the calling token’s scope/lifetime. tokens:manage permits listing and revoking existing tokens only.
• Approve hosted-app sign-in, select profile sharing, or issue a Notify pass. Changing an app’s origin resets its approval.
• Register a device through its native client and push-token flow.
• Accept a family or workplace invitation.
• Acknowledge or escalate a page.