Concepts
Projects and keys
Understand project isolation, bearer authentication, and the separate end-user boundary.
A project is the trusted isolation boundary for catalog policy, executions, connections, and idempotency. Every executor request authenticates one project key:
HTTP
Authorization: Bearer eyeball_project_keyThe key selects the project. It does not identify the human whose provider account should be used. Bind that separately with userId in the SDK or userId in the REST body.
| Identity | Supplied by | Purpose |
|---|---|---|
| Project | Bearer key | Trust, policy, execution isolation |
| External user | Your application | Connection and data isolation inside the project |
| Provider account | Connection resolver | Concrete Gmail, Slack, Stripe, or other account |
Use opaque, stable external user IDs. Never put provider tokens in tool input. A connection for user_42 cannot be selected by user_84, even if both users belong to the same project.
Next: Connected accounts.