> ## Documentation Index
> Fetch the complete documentation index at: https://impossibl.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and authentication

> How gateway API keys work, how agents self-register through auth.md, and how a human later claims the account that an agent opened on their behalf.

## API keys

Every request to a model endpoint needs a gateway API key:

```
Authorization: Bearer imp-rt-...
```

Keys are minted by `POST /v1/accounts` (first key) or `POST /v1/keys` (additional
keys), listed via `GET /v1/keys`, renamed via `PATCH /v1/keys/{id}`, and revoked via
`DELETE /v1/keys/{id}`. The raw key is shown **once** at creation; only a hash is
stored.

## Agent registration (auth.md)

The service publishes an executable agent onboarding manifest at
[`https://api.impossibl.com/auth.md`](https://api.impossibl.com/auth.md) and
`https://api.impossibl.com/.well-known/auth.md`.

Protected endpoints also advertise
`https://api.impossibl.com/.well-known/oauth-protected-resource` via the
`WWW-Authenticate` header.

Today the live agent flow is frictionless funded account creation: call
`POST https://api.impossibl.com/v1/accounts` to create a funded account and get a
gateway API key.

## Claiming an account

When an agent creates an account on a human's behalf, the human can take ownership
of it through the WorkOS auth.md **user claimed flow** (an RFC 8628-shaped claim
ceremony). This binds the agent-created account to the human's WorkOS identity so
they can sign in and manage it; the agent's API key keeps working afterward. See the
[agent quickstart](/docs/agent-quickstart) for the step-by-step curl walkthrough.

Two facts to know:

* The signed-in user's verified email must match the email the agent supplied, so an
  intercepted code alone can't claim the account.
* If the human already has an Impossibl AI API account, the agent-created account is **merged
  into it** — balance and keys carry over, and the agent's key keeps working. A claim
  fails with `access_denied` only if the account was already claimed by someone else.