Access control
finch decides who can reach a service before a request ever touches your machine. Everything is managed from the CLI: you choose, per service, whether callers need a key, and you choose what each key can reach.
A finch account belongs to one person. There are no teams, groups, shared members, or access-control rules to maintain: the scope of each key is the whole policy.
Three ways in
| Caller presents | Gets in when |
|---|---|
A finch_ key | The key is live (not revoked) and its scope is --all or names the service. Nothing else is checked. See Keys & auth. |
| An OAuth token | An MCP client that speaks OAuth (such as Claude's custom connectors) signed in as you, the account's owner. Anyone else's sign-in is refused. |
| Nothing | The service is set to public. It needs no key at all. |
Anything else is refused before it reaches your machine: a 401 when no key was sent, a 403 when the key is unknown, revoked or scoped to other services. There is no sign-in page in front of your services: a browser opening a key-protected service gets the same 401 an unauthenticated client does.
Key scope
Every key is scoped when it is minted, and that scope is the only thing that decides what it reaches. --service <name> limits it to one service; --all lets it reach every service on the account. There is no unscoped default.
finch keys mint scraper-only --service scraper
finch keys mint everything --allOne key per agent
The common setup: you run several MCP services and several agents, and each agent should reach only some of them. Mint one key per agent, scoped to what that agent needs. Revoking one key cuts off exactly one caller.
# a key for the research agent, scoped to one service
finch keys mint research-agent --service scraper
# see what exists, then revoke it later; access stops immediately
finch keys list
finch keys revoke <id>Public services
A service whose auth is public is open: no key, no OAuth. Use it for a web page or an API you mean to publish, and add --forward-all when you publish it so every path is forwarded, not just /<name>/mcp (see Web apps and REST APIs). Switch a service back to requiring a key at any time.
finch add docs-site --service http://127.0.0.1:3000 --public --forward-all
# later:
finch auth docs-site key # back to finch_ keys (and OAuth)
finch auth docs-site public # open to anyone again