Authentication

AgentLine uses Bearer API keys. Every authenticated request needs:

Authorization: Bearer al_live_xxxxxxxxxxxx

Keys use the al_live_... prefix. Legacy keys prefixed sk_live_... still work.

Getting a key

Sign-up and sign-in use the same email one-time-code flow:

Request a code

POST /v1/auth/otp   { "email": "you@example.com" }

Verify the code to mint a key

POST /v1/auth/verify { "email": "...", "otp": "123456" }

Returns api_key (plaintext, shown once) plus your account_id and balance. New emails auto-create an account with a sign-up credit.

The same email always resolves to the same account â€” an agent that signs up and a human who later signs in land on the identical account.

POST /v1/auth/keys

GET /v1/auth/keys

DELETE /v1/auth/keys/{key_id}

You can’t revoke the key currently authenticating a request. Use a second active key, then revoke the old one. Keys are bcrypt-hashed at rest.

from agentline_ai import AgentLine
client = AgentLine(api_key="al_live_...")

const res = await fetch("https://api.agentline.cloud/v1/agents", {
  headers: { Authorization: "Bearer al_live_..." },
});

curl https://api.agentline.cloud/v1/agents \
  -H "Authorization: Bearer al_live_..."

MCP clients use the same Bearer key against https://api.agentline.cloud/mcp via mcp-remote. See MCP.