Authentication and workspaces

Google OAuth

Google OAuth is intended for interactive clients. Scheduler Zero resolves the signed-in email to your account and starts in the workspace that is active in the web app. If that workspace is unavailable, it falls back to your most recently joined workspace.

OAuth sessions can use:

• listWorkspaces to view accessible workspaces.
• switchWorkspace to change the workspace used by subsequent tools.

API keys

API keys are intended for automation and headless clients. Send the key as a bearer token:

Authorization: Bearer sz_your_api_key_here

An API key is permanently scoped to the workspace where it was created. It cannot switch workspaces. Configure a separate MCP server entry with a separate key for each workspace an automation needs.

Permission scopes

API-key sessions list every REST operation exposed by the public OpenAPI contract. The API enforces the scopes selected under Settings → API Keys when a tool is called; a call outside those scopes is rejected with 403 Forbidden.

Keep scopes narrow, store keys in a secret manager, and revoke keys that are no longer used.