How it works
How an app signs in
- Key is a standard OpenID Connect provider at auth.superintelligentkey.com, with discovery, JWKS and PKCE.
- A person signs in with a six-digit code sent to their email. Key keeps no passwords.
- Your app gets a short-lived access token and an ID token, and checks them against Key's published keys.
How an agent signs in
- An agent names itself with a client metadata document, then sends the person to Key to sign in.
- The person sees which agent is asking and what it may do, and chooses Allow or Don't allow.
- With that consent the agent uses Key's MCP server at mcp.superintelligentkey.com, and every change it asks for is previewed before it happens.
Docs and contact
For developers
The API is described by its OpenAPI document, /v1/openapi.json on api.superintelligentkey.com, and the MCP server publishes its protected-resource metadata. Send a real User-Agent header with every request.
Security
Report a security issue to the contact in the security.txt file under /.well-known/ on any Key host.