An API without API keys: the wallet is the account
Three ways software authenticates on agentgates.ai: anonymous x402 where the paying wallet is the identity, revocable bearer keys minted on a prepaid balance, and OAuth for the wallet MCP server.
Anonymous by default
The compute and inference lanes need no registration: pay with x402 and the paying wallet IS the account. It owns what it buys, reads its own state, and no email, password or key exchange ever happens.
Bearer keys when you want them
A wallet can prepay an inference balance and mint revocable bearer API keys on it, so plain Authorization: Bearer clients work without signing per request. Keys draw from the balance and can never overdraw it; revoking a key never touches the funds.
OAuth for the wallet MCP server
The MCP server at agentgates.ai/mcp pairs an Agentgates wallet under owner-approved grants — standard OAuth 2.0 with PKCE and dynamic client registration. Every money-moving action is propose-only: the agent proposes, the wallet owner approves.
Machine-readable metadata: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. The prose version lives at /auth.md.
FAQ
How does software authenticate with no key?
By paying: the x402 payment signature identifies the wallet, and the wallet is the account.
What if my client can only send a bearer header?
Mint a revocable bearer key on a prepaid balance — the contract is in /api/inference/docs.
Where is the machine-readable auth spec?
/auth.md, plus RFC 8414 and RFC 9728 metadata under /.well-known/.