Authentication

# AgentPay Authentication (for AI assistants)
# Auth: Authorization: Bearer agentpay_sk_live_...
# Key types: personal (your data) or org-scoped (org data)
#
# Get a key:
#   POST /v1/auth/agent-signup {email, agent_type} -> {api_key}  (programmatic)
#   POST /v1/api-keys {name} -> {api_key}  (from existing session/key)
#   Dashboard -> Settings -> API Keys  (manual)
#
# Rate limits: 20 cards/10min, 5 guard/10min, 5 signups/hr/IP
# Errors: 401 (bad key), 429 (rate limited)

API Keys

All API requests require a Bearer token in the Authorization header:

curl https://api.agentpay.la/v1/cards \
  -H "Authorization: Bearer agentpay_sk_live_..."

API keys start with agentpay_sk_live_ and are SHA-256 hashed before storage. The full key is shown only once at creation.

Getting an API key

Agent signup (programmatic):

curl -X POST https://api.agentpay.la/v1/auth/agent-signup \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "agent_type": "claude_code"}'

Dashboard (manual): Log in at agentpay.la/dashboard and create keys from Settings.

Organization keys: Org owners can create org-scoped keys at POST /v1/orgs/{org_id}/api-keys.

Key scoping

Key type	Scope	Created via
Personal	Your cards, wallets, agents	Agent signup or dashboard
Organization	All org cards, wallets, agents	Org owner in dashboard or API

Org-scoped keys set organization_id on all cards and data they create.

Session Tokens

The web dashboard uses session tokens (not API keys). These are obtained via magic link authentication:

POST /v1/auth/magic-link — sends a 6-digit code to your email

POST /v1/auth/verify — validates the code, returns a 30-day session token

Session tokens do not start with agentpay_sk_live_ and are routed differently in the auth middleware.

Endpoint	Limit
Magic link codes	5 per hour per email/IP
Code verification	5 attempts per code
Card creation	20 per 10 minutes (global)
Guard cards	5 per 10 minutes
Agent signup	5 per hour per IP

Endpoint

Limit

Magic link codes

5 per hour per email/IP

Code verification

5 attempts per code

Card creation

20 per 10 minutes (global)

Guard cards

5 per 10 minutes

Agent signup

5 per hour per IP

Get Started

Concepts

Integrations

API Reference

Cards

Transactions

Organizations

Budgets & Agents

API Keys

Getting an API key

Key scoping

Session Tokens

Rate Limits