Carragent Com Authentication

generated: '2026-11-03'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://carragent.com/auth.md
sources:
- https://carragent.com/auth.md
description: Carragent API can be accessed without authentication, but optionally OAuth 2.0 tokens can be obtained via client credentials or JWT‑bearer
  grant to raise the rate limit.
schemes:
- type: oauth2
  name: OAuth 2.0 client credentials
  evidence: 'OAuth 2.0 client credentials (RFC 6749, section 4.4): a client you register once and keep. Its secret does not expire; its tokens
    last 1 hour.'
  flows:
  - client_credentials
  token_url: https://carragent.com/api/oauth2/token
  scopes:
  - agents:read
  - plans:read
  - search:read
  how_to_obtain: Register a client via POST https://carragent.com/api/oauth2/register, then request a token with grant_type=client_credentials
    using HTTP Basic authentication (client_id and client_secret) or form fields.
- type: oauth2
  name: OAuth 2.0 JWT‑bearer grant (anonymous agent registration)
  evidence: 'Anonymous agent registration (`anonymous`): the agent registers itself and keeps no client or secret. It holds an identity assertion
    for 24 hours and exchanges it for tokens (RFC 7523, the JWT-bearer grant).'
  flows:
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  token_url: https://carragent.com/api/oauth2/token
  scopes:
  - agents:read
  - plans:read
  - search:read
  how_to_obtain: 'POST https://carragent.com/agent/identity with body {"type": "anonymous"} to receive an identity_assertion JWT, then POST https://carragent.com/api/oauth2/token
    with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion=<identity_assertion>.'
note: Requests without an Authorization header are allowed (public read‑only access) with a limit of 60 requests per minute per IP.
docs: https://carragent.com/auth.md