# Let AI agents sign up and get an API key 97 of 151 products stop an AI agent at the door. How to let an agent sign up and get a limited key by API or CLI, with a person claiming it later. Source: https://agentdrives.com/guides/let-agents-sign-up-and-get-a-key?via=md · Updated 2026-10-25 · Wall: Browser-only sign-up Give agents an API call that signs up and returns a key with limits, and let a person claim the account later. ## The numbers From the drives of 151 products, 1–25 Oct 2026 (https://agentdrives.com/data/facts?via=md): - Products that stop an AI agent at the door: 97 of 151 - Products where the key had to be copied from a dashboard: 36 of 151 - Products that let it sign up without a browser: 6 of 151 ## What agents hit 97 of 151 products stop an AI agent at the door. At 89 of them, sign-up itself was the first step our agent couldn't pass. At 78 of them a bot check on the form was the reason: [let signed agents past it](https://agentdrives.com/guides/let-signed-agents-past-your-bot-check?via=md), or give agents the way in below. Past sign-up, the key is the next wall. At 36 of 151 products the key had to be copied from a dashboard in a browser, and our agent got a key without a browser at 13 of 151. ## The fix, step by step 1. **Add a sign-up call.** One POST with an email address creates the account and sends a code to that address. The agent reads the code and sends it back, all over the API. ``` POST /v1/signup {"email": "agent@example.com"} POST /v1/signup/verify {"email": "agent@example.com", "code": "…"} → 201 {"api_key": "…", "scope": "free"} ``` 2. **Return a key with limits.** The first key works on a free plan or a sandbox: small quotas, no money, nothing that reaches other people. Raise the limits once a person claims the account. Neon does this: an unclaimed database works at once, with small limits, and expires after 72 hours unless someone claims it. [1] 3. **Let a person claim it.** The agent hands its person a short code or a link, and the person signs in and takes the account over. In auth.md the person types the agent's code once signed in, [2] within 10 minutes [2]. Vercel's claim link for a deployment is a code valid for 24 hours. [3] 4. **Publish it where agents look.** auth.md puts an `agent_auth` block in your OAuth server's metadata, at `/.well-known/oauth-authorization-server` [2], with the ways an agent may register and the endpoint it POSTs to. [2] Link the sign-up call from your llms.txt and your API docs too. 5. **Make keys from the API or CLI.** Once signed in, an agent makes, lists and revokes its own scoped keys over the API. Where a person must approve, use the device flow: the agent shows a code, the person approves it once on any device. [4] ## Who already does it 6 of 151 products let our agent sign up without a browser: [AgentMail](https://agentdrives.com/tools/agentmail?via=md), [Cloudinary](https://agentdrives.com/tools/cloudinary?via=md), [DocuSeal](https://agentdrives.com/tools/docuseal?via=md), [Penpot](https://agentdrives.com/tools/penpot?via=md), [PlanetScale](https://agentdrives.com/tools/planetscale?via=md) and 1 other. ## Check it yourself 1. **Sign up from a terminal.** Use a new email address. You want the account and a code in the inbox, with no browser. ``` curl -s -X POST https://api.example.com/v1/signup \ -H "content-type: application/json" \ -d '{"email": "new-agent@example.com"}' ``` 2. **Use the key on a real call.** The first call that creates something should work with the new key. ``` curl -s https://api.example.com/v1/projects \ -H "authorization: Bearer $API_KEY" ``` 3. **Read your metadata like an agent.** If you publish auth.md, the block is here. ``` curl -s https://example.com/.well-known/oauth-authorization-server | jq .agent_auth ``` ## After the fix Fixed something? Tell us in your account and our agent drives it again for free, up to twice a year. ## Questions **Won't bots sign up by the thousand?** Limit what an unclaimed account can do: a small quota, no sending to other people, no money, an expiry date. Rate-limit sign-ups per email domain and per signer. A person's claim lifts the limits. **Do we still need the email code?** Yes. It ties the account to an inbox the agent controls, and an agent with its own inbox reads it in seconds. ## Sources 1. [Claimable Postgres](https://neon.com/docs/reference/claimable-postgres) 2. [auth.md](https://github.com/workos/auth.md/blob/main/AUTH.md) 3. [Claim deployments](https://vercel.com/docs/deployments/claim-deployments) 4. [RFC 8628, Device Authorization Grant](https://www.rfc-editor.org/rfc/rfc8628.txt) ## More guides - [Make your SaaS agent-ready: the whole path, step by step](https://agentdrives.com/guides/make-your-saas-agent-ready.md?via=md): Docs, sign-up, the key, MCP, paying and leaving: what an agent needs at each step, with the fix for each. - [An MCP server is not a way in for AI agents](https://agentdrives.com/guides/an-mcp-server-is-not-a-way-in.md?via=md): Most products have an MCP server. What an agent still needs behind it: an account, a key and a sign-in it can finish. - [How AI agents pay for software: x402, MPP and checkouts](https://agentdrives.com/guides/how-ai-agents-pay-for-software.md?via=md): Card checkouts, x402 and MPP: what an agent can pay with today, and what most products ask instead. - [llms.txt, OpenAPI and MCP alone don't let AI agents in](https://agentdrives.com/guides/agent-ready-files-dont-open-the-door.md?via=md): Most products publish llms.txt, OpenAPI or MCP. Most still keep agents out. What the files do, and what they can't. - [Test your product with an AI agent: the nine checkpoints](https://agentdrives.com/guides/test-your-product-with-an-ai-agent.md?via=md): The nine checkpoints of a drive, with the commands to try each one from a terminal. - [Let signed AI agents past your bot check](https://agentdrives.com/guides/let-signed-agents-past-your-bot-check.md?via=md): The setting for Cloudflare, Vercel, Akamai, DataDome and HUMAN, and what to do about a check on the form. - [Let AI agents sign up without a phone number](https://agentdrives.com/guides/sign-up-without-a-phone-number.md?via=md): No phone on the first step: an email code, a person who approves the agent, limits until they do. - [Let AI agents sign up with their own email address](https://agentdrives.com/guides/accept-any-email-address.md?via=md): Take any address that receives mail, confirm it with a mailed code, and limit new accounts instead of filtering domains. - [MCP sign-in an AI agent can finish: OAuth and CIMD](https://agentdrives.com/guides/mcp-sign-in-agents-can-finish.md?via=md): OAuth metadata, CIMD or DCR, and a way to approve without a browser on the agent's side. - [Let AI agents start without a credit card](https://agentdrives.com/guides/card-free-starts.md?via=md): A free plan or a trial without a card, an API key that works on it, and limits instead of a card. - [Let AI agents pay you per call: x402 and MPP](https://agentdrives.com/guides/let-agents-pay-per-call.md?via=md): x402 or MPP on a paid endpoint, your prices where agents read them, and plans an agent can buy by API or MCP. - [Docs AI agents can read: llms.txt, Markdown, OpenAPI](https://agentdrives.com/guides/docs-agents-can-read.md?via=md): An llms.txt, Markdown twins of your pages, an OpenAPI spec and an MCP server card. - [Let AI agents delete the account they opened](https://agentdrives.com/guides/let-agents-delete-their-account.md?via=md): A delete call for the account, a clear answer when it's done, and the same in the settings for people. Every guide: https://agentdrives.com/guides.md?via=md