Gnesi
Every API call that reads or writes an inbox needs a bearer token.
People
The web app sends the signed-in person's session. That token is short-lived. Do not paste it into a long-running agent.
Agents
Settings, Agent access, creates a Gnesi credential. The token is shown once. Send it as:
Authorization: Bearer gnesi_...
Gnesi stores only a hash. Rotate issues a new token and the previous one stops working.
OAuth for MCP clients
GET https://api.gnesi.io/.well-known/oauth-authorization-server publishes the metadata an MCP client uses to sign the person in. The resource is POST https://api.gnesi.io/api/mcp.
Failures
A missing or invalid token is 401 with Sign in required. on the conversation API, and Sign in to reserve an address. on the address API.