> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pomerado.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Understand authentication

> The two levels of sign-in: who you are to Pomerado, and who Pomerado is on a website.

Authentication in Pomerado has two separate levels, and this page explains both.

| Level | Answers | Credentials |
| - | - | - |
| Pomerado authentication | Who you are to Pomerado | OAuth sign-in, API keys, integration keys |
| Website logins | Who Pomerado is on a website | Saved logins |

## Pomerado authentication

Every request to Pomerado carries one credential, sent as `Authorization: Bearer`:

* **OAuth sign-in.** Your MCP client signs you in through a browser, with no key to handle. Best for chat and coding agents. See [sign in with OAuth](/guides/authentication/oauth).
* **API key.** A `pom_` token for programs and headless agents. See [API keys](/guides/authentication/api-keys).
* **Integration key.** An API key limited to one integration. See [integration keys](/guides/authentication/api-keys#integration-keys).

An agent without a browser can get an API key by having you approve a short code. See [sign in with a code](/guides/authentication/sign-in-with-a-code).

Whatever the credential, it acts for one account and never with more than your role allows. See [permissions](/guides/authentication/permissions).

On the Dashboard, your session renews itself, so you sign in again only after it ends or you sign out. Only deleting the account and changing the password ask for a sign-in within the last five minutes.

## Website logins

A website login is the account Pomerado signs in with on a site, such as your Instacart account. You save it once in the Dashboard, or on the protected page a job links to when it needs one, and jobs use it from then on. See [saved logins](/guides/logins/overview).

## How the two relate

The levels stay separate. Your Pomerado credential decides which saved logins a job may use, but it never holds a website password. Pomerado asks for a password only on its own protected pages, so never paste one into a chat or a request, and no API key or OAuth app can reveal one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.