Agents

Use your real account

Prefer MCP OAuth for supported AI hosts. REST integrations need a separate API key; an OAuth connection does not export one into your shell.

Use the email verification flow below with an address the user controls. Keep the returned key out of messages and logs, and store it through a secret facility or an explicitly approved local environment file. Never use a disposable account to recover an existing user's data.

The source signup contract also supports immediate keys for new agent+ addresses. That creates a separate identity; it does not grant customer or organization access. It is not the recommended onboarding path for customer work. Multiple API keys per account are supported, without revoking existing keys.

Standard signup (email verification)

If you're building a human-facing integration and want the user to verify their real email, use an email address the user controls:

Step 1 — request a verification code:

curl -X POST "https://api.recoupable.dev/api/agents/signup" \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'

Step 2 — submit the 6-digit code from the verification email:

curl -X POST "https://api.recoupable.dev/api/agents/verify" \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "code": "123456"}'

Response:

{
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "api_key": "recoup_sk_abc123...",
  "message": "Verified"
}

Using your API key

Pass the returned api_key in the x-api-key header on every authenticated request:

curl -X GET "https://api.recoupable.dev/api/tasks" \
  -H "x-api-key: YOUR_API_KEY"

See Authentication for the full authentication model, including organization access and Bearer token support, and Quickstart for your first end-to-end request.