---
title: "Why Build is OAuth-only"
description: "A Build PUT publishes as someone, so the token must belong to a person with Build authorization."
url: https://docs.spinrun.ai/build/authorization
markdown_url: https://docs.spinrun.ai/build/authorization.md
---

# Why Build is OAuth-only

The run surface accepts either a browser authorization or a workspace API key. Build accepts only the first. A key authenticates a workspace; a Build PUT publishes a new version of an agent as someone.


> **Build authorization:** Tick Build authorization on the consent screen, or enable it later under Settings → Applications (workspace owners only). A token without it gets 403 from /mcp/build and /api/build.


Every 401 carries a `WWW-Authenticate` header pointing at `/.well-known/oauth-protected-resource/mcp/build`.

## Related [#related]

* [Endpoints](https://docs.spinrun.ai/build/endpoints.md)
* [Publishing](https://docs.spinrun.ai/build/publishing.md)