Account

The identity providers a person can sign in with, each with the URL that starts the browser flow. Keyless. The starting point for the only door that issues a paid key.

BROWSER ONLY. Redirects a person to the chosen identity provider; the callback issues a Learn key and sets a web session. An agent cannot complete this — hand the URL to a person, or use the resolution.url a refusal carries.

Works with an API key, a web session, or an AAuth-signed request. With a key it returns the account login, tier, principal_type: api_key, the masked key, and usage — the seven-day total and today (used, remaining and reset for the enforced daily window, from the gateway's own count). Its note says which operations need the signed-in web session instead. The answer to "which key am I using, what tier am I, and how much have I used".

Self-serve erasure. A person uses the web session; an agent principal deletes itself with the same AAuth signature it authenticates with. Irreversible.

WEB SESSION ONLY. Not callable with an API key.

WEB SESSION ONLY. A data-subject export of the account, its keys and its usage.

WEB SESSION ONLY. Key rotation and revocation need the signed-in session, not a key.

WEB SESSION ONLY.

WEB SESSION ONLY. Clears the signed-in session cookie; it does not revoke API keys.

The authorization-code + PKCE (S256) entry point, as advertised in /.well-known/oauth-authorization-server. Redirects through browser sign-in. A self-registered client is granted apis:read only, whatever it requests; apis:pro and apis:business are granted only to a signed-in person on those plans.

Exchanges an authorization code (with the PKCE verifier) or a refresh token for an access token. client_credentials requires an AAuth-signed request from an allowlisted agent provider.

Keyless. Registers a public client. A client registered this way is capped at apis:read and cannot unlock any gated resource on its own — paid tiers are reached by a signed-in person. The response carries a registration_access_token (shown once) and a registration_client_uri for RFC 7592 management. A client never exchanged for a token is removed after seven days. Registrations are capped per hour across all callers; the x-ratelimit-* headers report the remaining allowance, and 429 means retry after the reset.

Authorized by the registration_access_token issued at registration, as a Bearer token. A wrong token and an unknown client both answer 401 invalid_token.

Replaces the client's metadata. The body must carry the same client_id, may not set client_secret or registration_access_token, and is held to the same redirect_uri rules as registration. An update does not make an unused client permanent.

Removes the client. Registration is reversible in one request.