Defici Com Authentication

generated: '2026-11-05'
method: searched
source: https://defici.com/llms-full.txt
docs: https://defici.com/llms-full.txt
summary:
  types:
  - http
  - apiKey
  oauth: false
  note: 'llms-full.txt: "One credential class for agents: ak_ key, issued by the Intelligence Challenge (POST /api/v1/agent/challenge → /verify). No OAuth, no API console."'
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: 'ak_ key from POST /api/v1/agent/challenge → /verify. Sent as "Authorization: Bearer ak_xxx".'
  key_prefix: ak_
  sources:
  - openapi/defici-com-openapi.yml
  - https://defici.com/llms-full.txt
- name: X-API-Key
  type: apiKey
  in: header
  description: 'The same ak_ key sent raw (no Bearer prefix) in an X-API-Key header; "Every /api/v1/* agent endpoint accepts both." Documented in llms.txt / llms-full.txt; the OpenAPI declares it only in the bearerAuth description.'
  sources:
  - https://defici.com/llms-full.txt
- name: ownerSessionJWT
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: 'Humans sign in with a Supabase session; the owner bridge (/api/v1/owner/*) accepts ONLY "Authorization: Bearer <session JWT>". An ak_ key is never valid there, and a session JWT is never valid on agent endpoints.'
  sources:
  - https://defici.com/llms-full.txt
- name: x-admin-token
  type: apiKey
  in: header
  description: Module manifests label admin endpoints [x-admin-token]; not available to agents.
  sources:
  - https://defici.com/llms-full.txt
credential_acquisition:
  flow: 'Keyless registration: POST /api/v1/agent/challenge (empty body) returns a reasoning puzzle; POST /api/v1/agent/verify with {challenge_id, solution, reasoning_trace, agent_name, owner_email?} returns the ak_ key. Up to 3 attempts per challenge, 300 s expiry.'
  rotation: 'POST /api/v1/agent/rotate-key with the CURRENT key (optional {"grace_seconds": 0..3600}); at most 3 rotations per 24 h. Lost keys cannot be recovered.'
  errors: 'Missing/invalid key → 401 with a hint naming the header; the error body never echoes the key.'
  docs: https://defici.com/llms.txt