find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/agentik-cc:agentik-cc-oauth-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Agentik agent OAuth API
  version: 0.1.0
  summary: 'Pay-per-call tools for AI agents: one API key, one prepaid balance, many providers.'
  description: 'Three primitives: discover (free, public), inspect (free, public), run (API key, billed per call). Prices are the providers'' own, without markup; a platform fee applies when a human tops up the balance. A run normally reserves its maximum. Tools with pricing.costMode=actual reserve an estimate and bill the exact provider receipt without a per-call cap; additional usage may be debited. Keys with optional spending caps cannot run these tools. Unused funds are released; uncertain consumption stays reserved for reconciliation, including after a connection error. Separate executions are charged separately; idempotency keys replay an existing execution. Some tools create a live resource (browser session, agent run): the run stays RUNNING and is settled when the resource ends. MCP (Streamable HTTP) is served at https://ai.agentik.cc/mcp with the same catalog and billing; it authorizes through OAuth 2.1 (metadata at https://ai.agentik.cc/.well-known/oauth-protected-resource/mcp) or the API key. https://ai.agentik.cc/mcp/public serves discover and inspect without credentials. Inspect each tool for its complete input schema. This document covers customer integration only.'
servers:
- url: https://api.agentik.cc
security: []
tags:
- name: OAuth
paths:
  /.well-known/oauth-protected-resource/mcp:
    get:
      tags:
      - OAuth
      summary: Protected resource metadata for /mcp (RFC 9728)
      description: Where MCP clients learn which authorization server protects /mcp. Also served at /.well-known/oauth-protected-resource.
      security: []
      responses:
        '200':
          description: Resource metadata
          content:
            application/json:
              schema:
                type: object
                properties:
                  resource:
                    type: string
                  authorization_servers:
                    type: array
                    items:
                      type: string
                  scopes_supported:
                    type: array
                    items:
                      type: string
      operationId: get_well_known_oauth_protected_resource_mcp
  /.well-known/oauth-protected-resource:
    get:
      tags:
      - OAuth
      summary: Protected resource metadata (root form)
      security: []
      responses:
        '200':
          description: Resource metadata
      operationId: get_well_known_oauth_protected_resource
  /.well-known/oauth-authorization-server:
    get:
      tags:
      - OAuth
      summary: Authorization server metadata (RFC 8414)
      description: Endpoints, PKCE S256, grant types, dynamic registration and client ID metadata document support. Also served at /.well-known/oauth-authorization-server/mcp.
      security: []
      responses:
        '200':
          description: Authorization server metadata
      operationId: get_well_known_oauth_authorization_server
  /oauth/register:
    post:
      tags:
      - OAuth
      summary: Dynamic client registration (RFC 7591)
      description: Open, rate limited per address. Public clients (token_endpoint_auth_method none) get no secret; confidential ones get a client_secret returned once. Alternatively, use an https URL as client_id pointing at a client metadata document.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - redirect_uris
              properties:
                client_name:
                  type: string
                redirect_uris:
                  type: array
                  items:
                    type: string
                token_endpoint_auth_method:
                  type: string
                  enum:
                  - none
                  - client_secret_post
                  - client_secret_basic
                grant_types:
                  type: array
                  items:
                    type: string
                    enum:
                    - authorization_code
                    - refresh_token
                client_uri:
                  type: string
                logo_uri:
                  type: string
                scope:
                  type: string
      responses:
        '201':
          description: Client registered
        '400':
          description: invalid_client_metadata or invalid_redirect_uri
        '429':
          description: Too many registrations from this address
      operationId: post_oauth_register
  /oauth/token:
    post:
      tags:
      - OAuth
      summary: 'Token endpoint: authorization_code (PKCE) and refresh_token (rotation)'
      description: Form-encoded. A reused refresh token or a replayed code revokes the whole authorization. Access tokens live one hour, refresh tokens thirty days.
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              - client_id
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                client_id:
                  type: string
                client_secret:
                  type: string
                code:
                  type: string
                redirect_uri:
                  type: string
                code_verifier:
                  type: string
                refresh_token:
                  type: string
                resource:
                  type: string
                scope:
                  type: string
      responses:
        '200':
          description: access_token, token_type Bearer, expires_in, refresh_token, scope
        '400':
          description: invalid_grant, invalid_request, invalid_scope or unsupported_grant_type
        '401':
          description: invalid_client
      operationId: post_oauth_token
  /oauth/revoke:
    post:
      tags:
      - OAuth
      summary: Token revocation (RFC 7009)
      description: Revokes the authorization behind an access or refresh token. Always 200.
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - token
              - client_id
              properties:
                token:
                  type: string
                client_id:
                  type: string
                client_secret:
                  type: string
      responses:
        '200':
          description: Revoked or unknown
        '401':
          description: invalid_client
      operationId: post_oauth_revoke
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: trk_...
      description: Workspace API key
    oauth:
      type: oauth2
      description: 'OAuth for MCP clients: PKCE S256, dynamic client registration or client ID metadata documents, refresh token rotation. With agent onboarding enabled, a verified account approves a dedicated execution key; otherwise the legacy authorization page accepts an existing workspace key. Tokens inherit the key policy.'
      flows:
        authorizationCode:
          authorizationUrl: https://api.agentik.cc/oauth/authorize
          tokenUrl: https://api.agentik.cc/oauth/token
          refreshUrl: https://api.agentik.cc/oauth/token
          scopes:
            run: Discover, inspect and run tools, paid from the workspace balance within the key's caps
externalDocs:
  url: https://api.agentik.cc/connect.md
  description: Connection guide
x-agentik-billing:
  payments_enabled: true
  topup_fee_model: added
  topup_fee_rate: 0.055
  topup_fee_min_usd: 0.8
  topup_min_usd: 5
  free_runs_per_day_unfunded: 50
  free_runs_per_day_funded: 1000