> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aeolo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and scopes

> Credential types, domain membership, and risk checks.

Aeolo commands are scoped by account and domain.

## Credential types

| Credential           | Used by                    | Notes                                                                          |
| -------------------- | -------------------------- | ------------------------------------------------------------------------------ |
| Browser login        | CLI on a developer machine | Stored in `~/.config/aeo/config.json`.                                         |
| `atok_*` Aeolo token | MCP, CI, external agents   | Sent as bearer auth. Prefer `read`; use `read_write` only for approved writes. |
| Dashboard session    | Web app                    | Not interchangeable with CLI config.                                           |

## Domain access

Most commands require a domain. Resolution differs by surface.

CLI resolution order:

1. Explicit `--domain`.
2. `AEOLO_DOMAIN_ID`.
3. Active domain selected by `aeo domain switch`.
4. Error asking the caller to choose a domain.

MCP clients should pass `domainId` in `aeo_execute_command`. Start with `aeo_list_domains`; omit `domainId` only when the account has exactly one obvious domain.

## Membership and billing

Remote requests must pass membership checks before reading or mutating a domain. Credit-metered operations also check billing state.

`read` tokens can run commands classified as read-only by the MCP command registry. `read_write` is required for mutations, paid jobs, public preview links, deploys, publishes, deletes, and external source access such as Google Drive reads. Treat `aeo_execute_command` as a mixed-risk tool: classify the command string before calling it.

High-risk examples:

* `aeo content deploy`
* `aeo post publish`
* `aeo visibility check run`
* `aeo audit run`
* `aeo content generate`
* `aeo reference analyze`
* `aeo video generate`

Agents should ask for explicit user confirmation before high-risk commands unless the workflow is already approved.