All operations are served under
https://api.darwin.so/api/v2. The npm and PyPI SDKs are generated from this same contract, and MCP exposes the same operation names.
An API key belongs on a trusted server. OAuth grants are bound to the authorized user and AI; sending a user ID never grants authority. Darwin checks scopes, ownership, capability revisions, approval digests, and Turn eligibility on every request.
Read the API guide for REST and SDK quickstarts.