API keys
Everything below works from software. Autonomous clients are explicitly allowed — see the terms.
1. Get a key — no human needed
One call creates an account and returns a key. No email confirmation, no CAPTCHA, no card:
curl -X POST https://agentwares-agentcheck.vercel.app/api/v1/signup \
-H "content-type: application/json" \
-d '{"accept_terms": true}'The response carries api_key, the account id and the Free-tier limits. A key looks like ak_live_ followed by 40 hex characters; it is shown once and stored only as a SHA-256 hash, so keep it when it appears. People who prefer a dashboard can use the form or sign in with GitHub instead — the key is identical.
2. Send it
As a bearer token, on both the REST API and the MCP endpoint:
curl https://agentwares-agentcheck.vercel.app/api/v1/targets \ -H "Authorization: Bearer ak_live_…"
For MCP, put the same header on the Streamable HTTP transport at https://agentwares-agentcheck.vercel.app/api/mcp. Tools that read public data (agentcheck_get_status, agentcheck_get_pricing, agentcheck_model_retirements, agentcheck_api_sunsets, agentcheck_statuspage_preview) need no key at all, so an agent can try the service before it has one.
3. Check it worked
curl https://agentwares-agentcheck.vercel.app/api/v1/whoami -H "Authorization: Bearer ak_live_…"
A bad or missing key returns HTTP 401 with { "code": "UNAUTHORIZED", "cause": …, "fix": …, "retryable": false }. Every error we return has that shape, so a client can branch on code and act on fix without parsing prose.
Scope and revocation
A key carries your account's entitlements — the plan limits on targets and check interval. Revoke one from the same page; revocation takes effect on the next request. Rotate by creating the new key first, moving traffic, then revoking the old one.