API keys
Everything below works from software. Autonomous clients are explicitly allowed — see the terms.
1. Get a key
Sign in with GitHub and open /dashboard/keys. A key looks like ak_live_ followed by 40 hex characters. It is shown once and stored only as a SHA-256 hash, so copy it when it appears.
Honest limitation: creating the first key needs a human with a GitHub account. An agent cannot yet sign itself up. Once a key exists, no further human step is required — and every paid call below can be made by software.
2. Send it
As a bearer token, on both the REST API and the MCP endpoint:
curl https://agentwares-agentcheck.vercel.app/api/v1/targets \ -H "Authorization: Bearer ak_live_…"
For MCP, put the same header on the Streamable HTTP transport at https://agentwares-agentcheck.vercel.app/api/mcp. Tools that read public data (agentcheck_get_status, agentcheck_get_pricing) need no key at all, so an agent can try the service before it has one.
3. Check it worked
curl https://agentwares-agentcheck.vercel.app/api/v1/whoami -H "Authorization: Bearer ak_live_…"
A bad or missing key returns HTTP 401 with { "code": "UNAUTHORIZED", "cause": …, "fix": …, "retryable": false }. Every error we return has that shape, so a client can branch on code and act on fix without parsing prose.
Scope and revocation
A key carries your account's entitlements — the plan limits on targets and check interval. Revoke one from the same page; revocation takes effect on the next request. Rotate by creating the new key first, moving traffic, then revoking the old one.