Agent Pass API

Auth: account endpoints require Authorization: Bearer <Agent Pass> (apiKey is the legacy field name).
Amounts are micro-dollars (µUSD): 1 = $0.000001, 1 cent = 10000. Balance, ledger, authorize, usage and topup all use it; the old cents field amount is rejected.
The browser account page also carries an HttpOnly session cookie, independent of Agent Pass expiry.
Product endpoints require a PRODUCT credential: Authorization: Bearer <product key>.

Accounts
  POST /api/v1/auth/register/start          { email, turnstileToken }   Send sign-up verification code (browser only: needs a Turnstile token; disposable domains are refused)
  POST /api/v1/auth/register/complete       { email, code, password }   Create account; returns apiKey, expiresAt, loginUrl, rotateUrl
  POST /api/v1/auth/login                   { email, password }         Sign in; returns apiKey, expiresAt, loginUrl, rotateUrl
  POST /api/v1/auth/password/reset/start    { email }                   Send password reset code
  POST /api/v1/auth/password/reset/complete { email, code, password }   Reset password (revokes existing credentials)
  POST /api/v1/auth/logout                                              Sign out: revoke the browser session / Bearer credential
  GET  /api/v1/me                                                       Account info, balance, and this device Agent Pass status
  GET  /api/v1/me/credentials                                           List active credentials
  POST /api/v1/me/credentials/revoke        { credentialId }            Revoke one credential
  POST /api/v1/me/agent-pass/rotate                                       Re-roll the Agent Pass (revokes every Agent Pass; sessions kept)
  GET  /api/v1/ledger                                                   Ledger and available balance
  GET  /api/v1/topup/options                                            Top-up amounts (micro-dollars) / Stripe configured?
  POST /api/v1/topup                        { amountMicros }            Create a Stripe Checkout session (checkoutUrl + expiresAt)
  GET  /api/v1/topup/session?sessionId=                                 Is this Checkout session mine? (top-up return)
  POST /api/v1/support                      { email, subject?, message } File a support ticket (web + agents)
  GET  /health                                                          Health check

Products (consumers) - mode B: the base layer keeps no price list; amountMicros is the caller figure, in micro-dollars (1 = $0.000001; 1 cent = 10000).
  POST /api/v1/authorize                    { agentPass, sku?, amountMicros, idempotencyKey } -> { allowed, accountId, holdId, expiresAt }   (amountMicros 0 = authenticate only; micro-dollars: 1 = $0.000001)
  POST /api/v1/usage                        { holdId, amountMicros, productStatus?, idempotencyKey } -> { chargedMicros, releasedMicros }
  GET  /api/v1/products/usage?from=&to=                                 Consumer self-audit
  GET  /api/v1/products/holds                                           Open holds (reconciliation)
  GET  /api/v1/products/skus                                            SKU declarations
  POST /api/v1/products/skus                { sku, maxAmount?, holdTtlSeconds? }
  POST /api/v1/products/rotate                                          Revoke every credential of this product
  Product keys are issued by the operator (scripts/register-product.mjs), never self-service; registered: workflow, workflow-test, poe-channel, cloudpal, cau.

Integration (web / application-layer products)
  GET  /embed.js                                                        Host launcher: AgentPass.open() or a [data-agent-pass] button
  GET  /embed?origin=<hostOrigin>                                       Popup page (top-level; session + Stripe behave normally)
  GET  /embed.md                                                        Integration guide (Markdown)

Errors: {"ok":false,"error":{"code":"...","message":"...","retryAfterSeconds"?}}
Codes: 6 digits, valid for 10 minutes, single use; one send per address per 60s, max 5 per 24h.
Support: max 5 tickets per email per day, 50 per network per day.
Machine-readable: https://agent-pass.turingcorp.net/llms.txt · /index.md · /openapi.json