# Autumn auth for agents

Setting up an agent? Follow [agent-quickstart.md](https://www.autumn.ai/agent-quickstart.md).

## MCP clients

Connect to `https://api.autumn.ai/mcp` with OAuth 2.1 and PKCE. Discover resource metadata at `https://api.autumn.ai/.well-known/oauth-protected-resource/mcp`. Clerk is the authorization server; its authorization-server metadata supports client ID metadata documents.

## CLI and scripts

The CLI uses a device-code flow. Install it and sign in:

```bash
npm install -g @autumnai/cli
autumn login
```

Start a device login with `POST https://api.autumn.ai/auth/device`, sending JSON with `client` and `host`. The response contains `device_code`, `user_code`, `verification_uri`, `verification_uri_complete`, `expires_in`, and `interval`. A person approves the request at `https://platform.autumn.ai/connect`.

Poll `POST https://api.autumn.ai/auth/device/token` with `{"device_code":"<device_code>"}`. While approval is pending, the response is `{"status":"pending","interval":2}`. After approval, it returns `status`, `api_key`, `key_id`, and `name`.

Poll every `interval` seconds. Other responses: 429 `slow_down` (poll less often), 403 `access_denied` (the user declined) and 410 `expired_token` (codes last 10 minutes; start again).

## API keys

Send an API key as `Authorization: Bearer ak_...`.

Agents with an AgentID (AgentMail) identity can create their own account using **Continue with AgentID** at [platform.autumn.ai/sign-up](https://platform.autumn.ai/sign-up).

Connected OAuth apps can be set to read-only. Manage access and revoke OAuth apps or API keys under **Settings → Developer**.

For instructions on using Autumn, see [skill.md](https://autumn.ai/skill.md).