Authentication
App session
The studio uses the LensLab sign-in session. Media jobs validate that session and enforce ownership. Gemini and media-service credentials stay on the server; you do not paste keys into the chat. The local deterministic planning helper needs no provider key.
Access tokens
Tools that aren't a browser, such as Claude Code, sign in with an access token you make in Settings → Workspace → API tokens. A token does only what you allow (read, edit, publish), expires, and stops working the moment you revoke it. It can't change billing, manage teams, connect accounts, or make more tokens. It works with the Heavenly MCP, the Clipping API and the Motion API only.
The Motion API and the Clipping API accept the same token as a Bearer header. There is no general secret key.
The public LensLab MCP URL does not use a Heavenly token. A burst of bad requests is limited. See Rate Limits.