# Let AI agents sign up and get an API key 88 of 140 products stop an AI agent at the door. How to let an agent sign up and get a limited key by API or CLI, with a person claiming it later. Source: https://agentdrives.com/fixes/let-agents-sign-up-and-get-a-key · Updated 2026-10-12 · Wall: Browser-only sign-up Give agents an API call that signs up and returns a key with limits, and let a person claim the account later. ## The numbers From the drives of 140 products, 1–16 Oct 2026 (https://agentdrives.com/data/facts?via=md): - Products that stop an AI agent at the door: 88 of 140 - Products where the key had to be copied from a dashboard: 35 of 140 - Products that let it sign up without a browser: 7 of 140 ## What agents hit 88 of 140 products stop an AI agent at the door. At 82 of them, sign-up itself was the first step our agent couldn't pass. At 73 of them a bot check on the form was the reason: [let signed agents past it](https://agentdrives.com/fixes/let-signed-agents-past-your-bot-check), or give agents the way in below. Past sign-up, the key is the next wall. At 35 of 140 products the key had to be copied from a dashboard in a browser, and our agent got a key without a browser at 15 of 140. The fix our drives gave owners, in their words: - [ActiveCampaign](https://agentdrives.com/tools/activecampaign?via=md): Offer agent sign-up with a claimable account. - [Acuity Scheduling](https://agentdrives.com/tools/acuityscheduling?via=md): Add an API to create and revoke keys. - [Airtable](https://agentdrives.com/tools/airtable?via=md): Let agents get a token without the web UI. - [Amplitude](https://agentdrives.com/tools/amplitude?via=md): Add a headless sign-up route. ## The fix, step by step 1. **Add a sign-up call.** One POST with an email address creates the account and sends a code to that address. The agent reads the code and sends it back, all over the API. ``` POST /v1/signup {"email": "agent@example.com"} POST /v1/signup/verify {"email": "agent@example.com", "code": "…"} → 201 {"api_key": "…", "scope": "free"} ``` 2. **Return a key with limits.** The first key works on a free plan or a sandbox: small quotas, no money, nothing that reaches other people. Raise the limits once a person claims the account. Neon does this: an unclaimed database works at once, with small limits, and expires after 72 hours unless someone claims it. [1] 3. **Let a person claim it.** The agent hands its person a short code or a link, and the person signs in and takes the account over. In auth.md the person types the agent's code once signed in, [2] within 10 minutes [2]. Vercel's claim link for a deployment is a code valid for 24 hours. [3] 4. **Publish it where agents look.** auth.md puts an `agent_auth` block in your OAuth server's metadata, at `/.well-known/oauth-authorization-server` [2], with the ways an agent may register and the endpoint it POSTs to. [2] Link the sign-up call from your llms.txt and your API docs too. 5. **Make keys from the API or CLI.** Once signed in, an agent makes, lists and revokes its own scoped keys over the API. Where a person must approve, use the device flow: the agent shows a code, the person approves it once on any device. [4] ## Who already does it 7 of 140 products let our agent sign up without a browser: [AgentMail](https://agentdrives.com/tools/agentmail?via=md), [Basecamp](https://agentdrives.com/tools/basecamp?via=md), [Cloudinary](https://agentdrives.com/tools/cloudinary?via=md), [DocuSeal](https://agentdrives.com/tools/docuseal?via=md), [Penpot](https://agentdrives.com/tools/penpot?via=md) and 2 others. ## Check it yourself 1. **Sign up from a terminal.** Use a new email address. You want the account and a code in the inbox, with no browser. ``` curl -s -X POST https://api.example.com/v1/signup \ -H "content-type: application/json" \ -d '{"email": "new-agent@example.com"}' ``` 2. **Use the key on a real call.** The first call that creates something should work with the new key. ``` curl -s https://api.example.com/v1/projects \ -H "authorization: Bearer $API_KEY" ``` 3. **Read your metadata like an agent.** If you publish auth.md, the block is here. ``` curl -s https://example.com/.well-known/oauth-authorization-server | jq .agent_auth ``` ## After the fix Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Questions **Won't bots sign up by the thousand?** Limit what an unclaimed account can do: a small quota, no sending to other people, no money, an expiry date. Rate-limit sign-ups per email domain and per signer. A person's claim lifts the limits. **Do we still need the email code?** Yes. It ties the account to an inbox the agent controls, and an agent with its own inbox reads it in seconds. ## Sources 1. [Claimable Postgres](https://neon.com/docs/reference/claimable-postgres) 2. [auth.md](https://raw.githubusercontent.com/workos/auth.md/main/AUTH.md) 3. [Claim deployments](https://vercel.com/docs/deployments/claim-deployments) 4. [RFC 8628, Device Authorization Grant](https://www.rfc-editor.org/rfc/rfc8628.txt) ## More fixes - [Let signed AI agents past your bot check](https://agentdrives.com/fixes/let-signed-agents-past-your-bot-check.md): The setting for Cloudflare, Vercel, Akamai, DataDome and HUMAN, and what to do about a check on the form. - [MCP sign-in an AI agent can finish: OAuth and CIMD](https://agentdrives.com/fixes/mcp-sign-in-agents-can-finish.md): OAuth metadata, CIMD or DCR, and a way to approve without a browser on the agent's side. - [Let AI agents start without a credit card](https://agentdrives.com/fixes/card-free-starts.md): A free plan or a trial without a card, an API key that works on it, and limits instead of a card. - [Let AI agents pay you per call: x402 and MPP](https://agentdrives.com/fixes/let-agents-pay-per-call.md): x402 or MPP on a paid endpoint, your prices where agents read them, and plans an agent can buy by API or MCP. - [Docs AI agents can read: llms.txt, Markdown, OpenAPI](https://agentdrives.com/fixes/docs-agents-can-read.md): An llms.txt, Markdown twins of your pages, an OpenAPI spec and an MCP server card.