Let agents sign up and get a key without a browser.

What agents hit

97 of 151 products stop an AI agent at the door.

At 92 of them, sign-up itself was the first step our agent couldn't pass. At 81 of them a bot check on the form was the reason: let signed agents past it, or give agents the way in below.

Past sign-up, the key is the next wall. At 34 of 151 products the key had to be copied from a dashboard in a browser, and our agent got a key without a browser at 13 of 151.

The fix, step by step

1. 1

   Add a sign-up call.

   One POST with an email address creates the account and sends a code to that address. The agent reads the code and sends it back, all over the API.

   POST /v1/signup        {"email": "agent@example.com"}
   POST /v1/signup/verify {"email": "agent@example.com", "code": "…"}
   → 201 {"api_key": "…", "scope": "free"}

2. 2

   Return a key with limits.

   The first key works on a free plan or a sandbox: small quotas, no money, nothing that reaches other people. Raise the limits once a person claims the account. Neon does this: an unclaimed database works at once, with small limits, and expires after 72 hours unless someone claims it.¹

3. 3

   Let a person claim it.

   The agent hands its person a short code or a link, and the person signs in and takes the account over. In auth.md the person types the agent's code once signed in,² within 10 minutes². Vercel's claim link for a deployment is a code valid for 24 hours.³

4. 4

   Publish it where agents look.

   auth.md puts an agent_auth block in your OAuth server's metadata, at <authorization server>/.well-known/oauth-authorization-server², with the ways an agent may register and the endpoint it POSTs to.² Link the sign-up call from your llms.txt and your API docs too.

5. 5

   Make keys from the API or CLI.

   Once signed in, an agent makes, lists and revokes its own scoped keys over the API. Where a person must approve, use the device flow: the agent shows a code, the person approves it once on any device.⁴

Who already does it

6 of 151 products let our agent sign up without a browser: AgentMail, Cloudinary, DocuSeal, Penpot, PlanetScale and 1 other.

Check it yourself

1. Sign up from a terminal.

   Use a new email address. You want the account and a code in the inbox, with no browser.

   curl -s -X POST https://api.example.com/v1/signup \
     -H "content-type: application/json" \
     -d '{"email": "new-agent@example.com"}'

2. Use the key on a real call.

   The first call that creates something should work with the new key.

   curl -s https://api.example.com/v1/projects \
     -H "authorization: Bearer $API_KEY"

3. Read your metadata like an agent.

   If you publish auth.md, the block is here.

   curl -s https://example.com/.well-known/oauth-authorization-server | jq .agent_auth

Written by our agents from our drives and the vendors' own docs. How we write.