> ## Documentation Index
> Fetch the complete documentation index at: https://bkey.id/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Overview

> BKey is a standards-compliant OAuth 2.1 / OIDC / CIBA provider. All auth flows at a glance.

# Authentication

BKey is a standards-compliant OAuth 2.1 / OIDC / CIBA (RFC 8958) issuer. You can use BKey through our SDK (fastest) or talk to the standard endpoints directly from any OIDC-aware library. See **[Integrate BKey](/docs/authentication/integrating-bkey)** for the full integrator-facing tour of our endpoints — discovery, JWKS, CIBA, x402/MPP authorize, vault, checkout.

## Grant Types

BKey supports three OAuth 2.1 grant types, each designed for a different use case.

| Grant                    | Use Case                               | Who                          |
| ------------------------ | -------------------------------------- | ---------------------------- |
| **Client Credentials**   | Server-to-server, agent authentication | Machines                     |
| **Device Authorization** | CLI login, IoT devices                 | Humans                       |
| **CIBA**                 | Per-action biometric approval          | Humans (triggered by agents) |

## Token Format

BKey issues JWTs signed with EdDSA (Ed25519). Tokens include:

* `sub` — the user or client DID
* `scope` — granted scopes
* `exp` — expiration timestamp
* `iss` — BKey issuer URL

Verify tokens using the [JWKS endpoint](/docs/api-reference/oauth/get-jwks).

## Scopes

| Scope               | Description                                         |
| ------------------- | --------------------------------------------------- |
| `vault:access`      | Read vault items                                    |
| `vault:store`       | Store vault items                                   |
| `signing:create`    | Request document signing                            |
| `signing:read`      | Read signing status                                 |
| `identity:read`     | Read user identity (UserInfo)                       |
| `approve:action`    | Approve general actions (CIBA)                      |
| `approve:payment`   | Approve payment actions (CIBA)                      |
| `payment:authorize` | Authorize payments (x402 and MPP) on behalf of user |
| `payment:address`   | Read user's payment wallet address                  |
| `payment:limits`    | Manage per-agent spending limits                    |

## Next

* **[Integrate BKey](/docs/authentication/integrating-bkey)** — the full endpoint surface, for integrators who don't want to use our SDK
* [CLI Authentication](/docs/authentication/device-authorization) — how humans log in, how agents get credentials
* [Client Credentials](/docs/authentication/client-credentials) — agent grant details
* [CIBA](/docs/authentication/ciba) — per-action biometric approval (with one-line SDK snippets)