Skip to main content

​
API keys

Every request to a model endpoint needs a gateway API key:
Keys are minted by POST /v1/accounts (first key) or POST /v1/keys (additional keys), listed via GET /v1/keys, renamed via PATCH /v1/keys/{id}, and revoked via DELETE /v1/keys/{id}. The raw key is shown once at creation; only a hash is stored.

​
Agent registration (auth.md)

The service publishes an executable agent onboarding manifest at https://api.impossibl.com/auth.md and https://api.impossibl.com/.well-known/auth.md. Protected endpoints also advertise https://api.impossibl.com/.well-known/oauth-protected-resource via the WWW-Authenticate header. Today the live agent flow is frictionless funded account creation: call POST https://api.impossibl.com/v1/accounts to create a funded account and get a gateway API key.

​
Claiming an account

When an agent creates an account on a human’s behalf, the human can take ownership of it through the WorkOS auth.md user claimed flow (an RFC 8628-shaped claim ceremony). This binds the agent-created account to the human’s WorkOS identity so they can sign in and manage it; the agent’s API key keeps working afterward. See the agent quickstart for the step-by-step curl walkthrough. Two facts to know:
  • The signed-in user’s verified email must match the email the agent supplied, so an intercepted code alone can’t claim the account.
  • If the human already has an Impossibl AI API account, the agent-created account is merged into it — balance and keys carry over, and the agent’s key keeps working. A claim fails with access_denied only if the account was already claimed by someone else.