> For the complete documentation index, see [llms.txt](https://rawctx.gitbook.io/rawctx-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rawctx.gitbook.io/rawctx-docs/documentation/workspaces-and-authentication.md). # Workspaces and authentication rawctx separates public receipt and verification flows from authenticated workspace operations. ## Public surface Use the public Hub to create a no-sign-up hash-only receipt and inspect supported public verification material. ## Workspace surface Authentication is required for answer evidence, reconciliation, evidence assets, lifecycle review, exports, token management, settings, policy, and trust administration. Always perform these operations in the workspace that owns the data. ## Login selects the tenant registry ```bash rawctx login ``` Login saves both the API token and the current tenant registry in the local configuration. Normally omit `--registry` or `registry=` from later CLI and SDK calls so they reuse that tenant boundary. Use an explicit registry only when automation intentionally selects a known workspace API host. Do not override a workspace token to an unrelated API host, and never use the Hub browser BFF as the SDK registry. ## Role boundaries * **Application runtime:** create or read records for its bound `application_key` using only required scopes. * **Workspace reviewer/manager:** review records, append lifecycle events, manage evidence, export bounded datasets, and update policy. * **Platform operations:** operate checkpoints, anchors, witnesses, and scheduled platform tasks. Authentication proves which workspace principal made a request. It does not by itself prove answer accuracy, delivery, actual source use, or the truth of submitted external content. ## Runtime credential boundary Interactive login produces a user API token for developers and operators doing CLI work on a trusted machine. Do not use it to bootstrap a production server. For a production answer runtime, a workspace administrator signs in to the workspace Hub, opens **Settings > Access & team > API tokens**, and creates a separate token for that deployment. Store the one-time token value in the deployment platform's secret manager and inject it as `RAWCTX_TOKEN`; do not run `rawctx login` in the server or container. Current UI-issued API tokens are scoped to a workspace and user, not to one `application_key`. Use one token per deployment, keep its expiration short, and rotate or revoke it from the UI. ## Before the first production write Have a tenant manager confirm the question/answer text-storage flags, default retention window, keyed-hash mode, active hash-key identifier, and who may export or redact records. These controls are independent; sending text for tenant HMAC derivation does not mean the text is stored. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://rawctx.gitbook.io/rawctx-docs/documentation/workspaces-and-authentication.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.