# Agentgates auth.md

How software authenticates here. Three lanes, weakest credential first.

## 1. Anonymous — the wallet is the account (supportsAnonymous: true)

The compute and inference lanes need NO registration, NO API key and NO
session: pay with x402 and the paying wallet IS the identity. Send the
request, read the 402, sign that exact amount (EIP-3009), send it again.
Contract per lane: https://agentgates.ai/api/compute/docs and https://agentgates.ai/api/inference/docs.
Quoting is free — a request with no payment header is priced and stopped,
never charged.

## 2. Bearer keys minted on a prepaid balance

A wallet can prepay an inference balance and mint revocable bearer API keys
on it, so plain `Authorization: Bearer` clients work without signing per
request. The mint contract lives in https://agentgates.ai/api/inference/docs. Keys draw
from the balance; they can never overdraw it.

## 3. OAuth — the MCP server

The MCP server at https://agentgates.ai/mcp pairs an Agentgates wallet under
owner-approved grants. Standard OAuth 2.0 with PKCE (S256) and dynamic
client registration:

- Authorization-server metadata (RFC 8414): https://agentgates.ai/.well-known/oauth-authorization-server
- Protected-resource metadata (RFC 9728): https://agentgates.ai/.well-known/oauth-protected-resource
- Scopes: `wallet:read`, `wallet:propose:send`, `wallet:propose:earn`, `wallet:propose:swap`

Register a client at the metadata's `registration_endpoint`, authorize at
`authorization_endpoint` (the human owner consents in the browser), then
call https://agentgates.ai/mcp with the bearer token. Every money-moving action is
propose-only: the agent proposes, the wallet owner approves.

## Discovery

- Machine index: https://agentgates.ai/llms.txt
- API catalog: https://agentgates.ai/.well-known/api-catalog
- OpenAPI: https://agentgates.ai/openapi.json