Exchange the code without authentication: POST https://harkstudio.io/api/v1/pair with { "code": "YOURCODE" }, or call pair on https://harkstudio.io/mcp. The response returns access_key once, label, scope and expires_at. Store the key privately; never echo it into chat or logs. All other tools require authentication. Pairing is IP-rate-limited; used and expired codes are refused.
Keys default to Propose and expire in 90 days; choose Read + write only when those permissions are needed. A key can expire in 30 days, 90 days, 1 year or never. Copy key is a separate show-once path for storing it yourself; Regenerate key invalidates the old key immediately.
Loop: list_tasks → get_task → claim_task → add_task_note / add_attempt → complete_task. Ask the human before recording a decision.
Relayed approvals: pending_decisions for the ready-made ask, then accept_candidate with ids and relayed_from_human: { quote, channel: sms | chat | voice | other, asked_at, answered_at }. REST: GET /api/v1/projects/{code}/pending-decisions and POST /api/v1/decisions/accept.
Trust per key: Standard (completions wait), Relaxed (default; notes and completions auto-accept), Autopilot. Decisions, non-goals and phase changes never auto-accept.