Authentication.
Scovant supports two authentication methods:
OAuth (dashboard login)
Sign in with Google or GitHub at /login. OAuth identities are auto-linked to existing accounts by verified email address.
API tokens (programmatic access)
Create API tokens in Settings → API tokens (workspace owner only). Tokens use the format scvt_ followed by 43 URL-safe characters and are shown once on creation. Each workspace holds one active token at a time — creating a second returns 409 {"error": "token_already_exists"}; revoke the current token first. Use them as Bearer tokens:
Authorization: Bearer scvt_...
API tokens authenticate programmatic scan triggers (POST /api/scans), simulation launches (POST /api/simulations), and the CI trigger endpoint (POST /api/ci/trigger). The authenticated tools on the MCP interface accept the same bearer token — that is the token's read path for scan results, regressions, simulations, and Fix Plans. A token is scoped to the workspace it was created in: it can only act on that workspace's sites.