# API authentication & quickstart

Base URL: `https://agentauthority.org`

## Authentication

| Routes | How |
| --- | --- |
| `/api/public/*`, `/api/verification/*` | None |
| `/api/connect/prepare`, `/api/connect/proof` | `Authorization: Bearer TOKEN`, from the registration request |
| Other `/api/*` routes | Signed-in portal session. Changes must come from the registry's own origin. |

TODO: API keys for third-party apps. None exist today.

## Quickstart

Your agent sends its public key with the token from the registration request file:

```sh
curl -X POST https://agentauthority.org/api/connect/prepare \
  -H "Authorization: Bearer YOUR_REGISTRATION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"public_key": "YOUR_AGENT_PUBLIC_KEY"}'
```

The public key is the raw 32-byte Ed25519 key, base64url without padding. The response is a registry-signed handoff. The agent signs it and sends the signature to `/api/connect/proof`. `registry.agent_connect` does both steps for you.

Never send the private key.

## Reference

- [API reference](/api/)
- [Interactive reference](/api/reference)
- [OpenAPI schema](/openapi.json)