> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dakota.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# auth.md

> Agent registration and authentication metadata for the Dakota Platform API, following the auth.md discovery convention.

# auth.md

This document describes how autonomous agents authenticate with the Dakota Platform API. It follows the [auth.md](https://github.com/workos/auth.md) agent-registration discovery convention.

Dakota Platform does **not** expose an OAuth authorization server for third-party agents. Programmatic access is provisioned through API keys created in the Dakota Platform dashboard, so the OAuth metadata files (`/.well-known/oauth-protected-resource`, `/.well-known/oauth-authorization-server`) are not the canonical entrypoint for agent registration. Use the instructions below.

## Agent audience

* **Resource:** `https://api.platform.dakota.xyz` (production), `https://api.platform.sandbox.dakota.xyz` (sandbox)
* **Documentation:** `https://docs.dakota.xyz`
* **OpenAPI specification:** `https://docs.dakota.xyz/openapi.json`
* **MCP server:** `https://mcp.platform.dakota.xyz/mcp` (production, HTTPS only)

## Registration

To provision credentials for an agent, a Dakota Platform account is required.

1. **Request a Dakota Platform account.** New customers and partners contact the Dakota team at [https://dakota.xyz/talk-to-sales](https://dakota.xyz/talk-to-sales). Existing customers can invite additional users from the dashboard.
2. **Sign in to the dashboard.**
   * Production: [https://platform.dakota.xyz](https://platform.dakota.xyz)
   * Sandbox: [https://platform.sandbox.dakota.xyz](https://platform.sandbox.dakota.xyz)
3. **Create an API key.** Open the **API keys** section in the sidebar, click **Create New API Key**, and give it a descriptive name (e.g. `agent-prod-ingest`). The key value is shown only once — copy it immediately into the agent's secret store.
4. **Scope the key.** The key inherits the permissions of the user that created it. Create a dedicated user with least-privilege access for production agents.
5. **Revocation.** Keys can be revoked at any time from the same dashboard view. Rotate keys on a schedule appropriate to the agent's blast radius.

There is no machine-to-machine self-service registration endpoint. All key issuance is gated on a Dakota Platform account.

## Supported authentication methods

| Method                           | Resource                                   | Notes                                                                                                      |
| -------------------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
| **API key** (`x-api-key` header) | REST API (`api.platform.dakota.xyz`)       | Primary mechanism. Required on every request.                                                              |
| **API key as Bearer token**      | MCP server (`mcp.platform.dakota.xyz/mcp`) | Same key, passed as `Authorization: Bearer <key>` on MCP registration. Recommended for AI clients.         |
| **OAuth 2.1 (Stytch)**           | MCP server only                            | Browser-based sign-in restricted to allowlisted internal Google domains. Not available to external agents. |

API keys are base64-encoded strings, exactly 60 characters (e.g. `AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=`).

## Applying credentials

### REST API

All requests require the `x-api-key` header:

```http theme={null}
GET /customers HTTP/1.1
Host: api.platform.dakota.xyz
x-api-key: AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc=
Content-Type: application/json
```

`POST`, `PUT`, and `PATCH` requests additionally require an `x-idempotency-key` header containing a unique UUID per request.

See [API Keys & Headers](/documentation/authentication/api-keys-headers) for full examples in cURL, JavaScript, Python, Go, Rust, and Java.

### MCP server

Register the Dakota MCP server with your AI client using the API key as a Bearer token:

```json theme={null}
{
  "mcpServers": {
    "dakota": {
      "url": "https://mcp.platform.dakota.xyz/mcp",
      "headers": {
        "Authorization": "Bearer AHGlPZaxDSMz8Wf1l8VRH4ObdbHiKsWFWnmRyHtiwAc="
      }
    }
  }
}
```

See [MCP Server](/documentation/mcp-server) for client-specific setup (Claude Desktop, Cursor, ChatGPT).

## Security expectations

* **Transport:** HTTPS only. Plain HTTP requests are rejected.
* **Storage:** Treat API keys as production secrets. Store them in a secret manager, never in source control.
* **Rotation:** Rotate keys when an agent's deployment changes hands or on a fixed cadence (90 days recommended).
* **Rate limits:** See [Rate Limiting](/documentation/authentication/rate-limiting).
* **Incident response:** Compromised keys should be revoked immediately from the dashboard and a new key issued.

For broader guidance, see the [Security](/documentation/authentication/security) page.

## Contact

* Sales / new accounts: [https://dakota.xyz/talk-to-sales](https://dakota.xyz/talk-to-sales)
* Customer support: [https://support.dakota.xyz](https://support.dakota.xyz)