Skip to main content

​
API keys

Every request to a model endpoint needs a gateway API key:
Keys are minted by POST /v1/accounts (first key) or POST /v1/keys (additional keys), listed via GET /v1/keys, renamed via PATCH /v1/keys/{id}, and revoked via DELETE /v1/keys/{id}. The raw key is shown once at creation; only a hash is stored.

​
Agent registration (auth.md)

The service publishes an executable agent onboarding manifest at https://api.impossibl.com/auth.md and https://api.impossibl.com/.well-known/auth.md. Protected endpoints also advertise https://api.impossibl.com/.well-known/oauth-protected-resource via the WWW-Authenticate header. Today the live agent flow is frictionless funded account creation: call POST https://api.impossibl.com/v1/accounts to create a funded account and get a gateway API key.

​
Claiming an account

When an agent creates an account on a human’s behalf, the human can take ownership of it through the auth.md user claimed flow (an RFC 8628-shaped claim ceremony). This binds the agent-created account to the human’s verified identity so they can sign in and manage it; the agent’s API key keeps working afterward. See the agent quickstart for the step-by-step curl walkthrough. Three facts to know:
  • The signed-in user’s verified email must match the email the agent supplied, so an intercepted code alone can’t claim the account.
  • The first claim makes the agent-created account a workspace owned by the claimer, keys and balance intact — even if they already have other workspaces. Nothing is merged; they switch between workspaces in the console.
  • A later claim of the same account, started by the agent with a different person’s email, adds that person to the workspace as a developer. This is how an agent invites a teammate. The agent’s key keeps working throughout.