# Authentication for agents

> How an AI agent obtains and uses a credential for the 0layers public API: discovery, registration, use, errors, and revocation.

## Authentication for agents

0layers uses long-lived API keys as bearer tokens. There is no OAuth authorization server, no dynamic client registration, and no delegated agent identity. This page says exactly what exists, so an agent does not spend requests probing for endpoints that are not there.

### Discover

The public API is described at [/openapi.json](https://0layers.com/openapi.json), catalogued at [/.well-known/api-catalog](https://0layers.com/.well-known/api-catalog), and documented at [/developers](https://0layers.com/developers). The OpenAPI security scheme is HTTP bearer.

There is deliberately no `/.well-known/oauth-protected-resource`, no `/.well-known/oauth-authorization-server`, and no `agent_auth` discovery block, because there is no OAuth server behind them. Publishing either would point an agent at endpoints that do not resolve.

### Pick a method

One method: a bearer API key. There is no `anonymous` or `identity_assertion` agent identity type — every request is attributed to the human whose key it carries.

Keys are scoped to the user who created them and carry that user’s full account permissions — there are no per-scope restrictions, so treat a key as equivalent to account access and do not ask a user to share one casually.

### Register

Key creation requires an authenticated human session; there is no `register_uri` an agent can call. The user signs in, opens `/settings/api-keys` from the account menu, and creates a key there, where it is displayed once and never shown again.

An agent acting for a user should ask that user to create a key and paste it in, then store it the way it stores any other long-lived secret.

### Claim

Not applicable. There is no claim step, no identity assertion exchange, and no `id-jag` flow. The key the user created is the credential.

### Use the credential

Send the key as a bearer token on every request. Keys begin with `0l_live_`.

curl -sS "https://flexible-sandpiper-126.convex.site/api/v1/brands" \\
  -H "Authorization: Bearer 0l\_live\_…"

### Errors

A missing, malformed, invalid, or revoked key returns `401` with an error envelope. Do not retry a `401` with the same key; it will not start working. Rate limiting returns `429` and should be retried after a back-off. The full table is on the [developer page](https://0layers.com/developers#errors).

Because there is no protected-resource metadata to point at, the `401` does not carry a `WWW-Authenticate: Bearer resource_metadata=…` header.

### Revocation

Keys are revoked from `/settings/api-keys`, the same screen that creates them, and revocation takes effect immediately. There is no agent-callable revocation endpoint. If a key has leaked, revoke it there; if you cannot sign in, email [hello@0layers.com](mailto:hello@0layers.com) from the account address.