EmbodiFlow has three kinds of credential, each made for one job. Whichever you use, the server works out your team from the credential itself, so you never pass a team in a request.
| Credential | Use it for |
|---|---|
| Browser session | The console. It's an HttpOnly cookie; don't reuse it in scripts. |
| Personal access token | Your own CLI and integrations. |
| API key | Team-wide automation, managed by admins. |
Scripts send the credential as Authorization: Bearer <token>. You choose a credential's permissions when you create it, and they can't be widened later. If a script needs more, create a new credential.