Build
Why Build is OAuth-only
A Build PUT publishes as someone, so the token must belong to a person with Build authorization.
The run surface accepts either a browser authorization or a workspace API key. Build accepts only the first. A key authenticates a workspace; a Build PUT publishes a new version of an agent as someone.
Build authorization
Tick Build authorization on the consent screen, or enable it later under Settings → Applications (workspace owners only). A token without it gets 403 from /mcp/build and /api/build.
Every 401 carries a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource/mcp/build.