Authentication

Every endpoint takes one of:

Scheme	How to send it	Access
Workspace API key	`api-key: <key>` header. Find it in Letterdrop under Settings → Integrations → API Key.	Full access to the workspace.
MCP OAuth token	`Authorization: Bearer <token>`	The scopes granted when the token was issued.

Scope	Grants
`mcp.read`	Every endpoint in this API (all are reads). Part of every token.
`mcp.write`	Actions elsewhere in Letterdrop (sending messages, changing workflows). Not needed here.

A credential in the query string is rejected. A credential only ever reads its own workspace.