Authentication for agents
0layers uses long-lived API keys as bearer tokens. There is no OAuth authorization server, no dynamic client registration, and no delegated agent identity. This page says exactly what exists, so an agent does not spend requests probing for endpoints that are not there.
Discover
The public API is described at /openapi.json, catalogued at /.well-known/api-catalog, and documented at /developers. The OpenAPI security scheme is HTTP bearer.
There is deliberately no /.well-known/oauth-protected-resource, no /.well-known/oauth-authorization-server, and no agent_auth discovery block, because there is no OAuth server behind them. Publishing either would point an agent at endpoints that do not resolve.
Pick a method
One method: a bearer API key. There is no anonymous or identity_assertion agent identity type — every request is attributed to the human whose key it carries.
Keys are scoped to the user who created them and carry that user’s full account permissions — there are no per-scope restrictions, so treat a key as equivalent to account access and do not ask a user to share one casually.
Register
Key creation requires an authenticated human session; there is no register_uri an agent can call. The user signs in, opens /settings/api-keys from the account menu, and creates a key there, where it is displayed once and never shown again.
An agent acting for a user should ask that user to create a key and paste it in, then store it the way it stores any other long-lived secret.
Claim
Not applicable. There is no claim step, no identity assertion exchange, and no id-jag flow. The key the user created is the credential.
Use the credential
Send the key as a bearer token on every request. Keys begin with 0l_live_.
curl -sS "https://flexible-sandpiper-126.convex.site/api/v1/brands" \ -H "Authorization: Bearer 0l_live_…"
Errors
A missing, malformed, invalid, or revoked key returns 401 with an error envelope. Do not retry a 401 with the same key; it will not start working. Rate limiting returns 429 and should be retried after a back-off. The full table is on the developer page.
Because there is no protected-resource metadata to point at, the 401 does not carry a WWW-Authenticate: Bearer resource_metadata=… header.
Revocation
Keys are revoked from /settings/api-keys, the same screen that creates them, and revocation takes effect immediately. There is no agent-callable revocation endpoint. If a key has leaked, revoke it there; if you cannot sign in, email hello@0layers.com from the account address.