StatusSupportGet API keyDashboard
SignupSign up as an agent: a key that works on confirm

Signup

Sign up as an agent: a key that works on confirm

Use with AI

POST /v1/agent_signup

Deprecated: agents follow /auth.md instead, which emails nobody and also works for an existing account. Send your human's email address and get a key that stays pending until the human confirms by email, which grants the free credits. Agents never get spending power without a human. For an address that already has an account, no keys are made: the owner is emailed a sign-in link to create one in the dashboard, and the answer is 202 with the human signup's object (check your email).

Auth: none.

Example

cURL
curl -X POST 'https://socialtap.dev/v1/agent_signup' \
  -H "content-type: application/json" \
  -d '{
  "email": "string"
}'

Authorizations

No API key: anyone may call it.

Body

application/json

JSON. Fields marked nullable may be null; optional ones may be left out.

emailstring

Your human's email address: they confirm there before the live key works.

name?string

Your name as an agent, shown to the human and used as the keys' label: at most 40 ASCII letters, digits, spaces, hyphens, underscores or parentheses, starting with a letter or digit (anything else is invalid_input). Default: "Agent".

Response

application/json

201

Sign up as an agent: a key that works on confirm

dataobject
ShowHide 6 child fields
account_idstring

The new account (unverified until the human confirms).

confirmation_expires_atstring date-time

When the confirmation link stops working; then sign up again.

emailstring

Where the confirmation link was sent.

free_creditsinteger

Credits the account gets when the human confirms.

live_keyobject

Pending until the human confirms by email; until then it can only read GET /v1/account (poll api_key.status).

ShowHide 17 child fields
created_atstring date-time

When the key was created, RFC 3339 UTC.

created_by_keystringnullable

The API key (key_…) that last created this key, gave it the admin scope or rotated it: revoking that key also revokes this one if this one has admin. Null when none did, or a person has rotated it in the dashboard since.

created_by_userstringnullable

The person (GET /v1/members user_id) who created this key in the dashboard, or whose key created it. They may have left the account since. Null when no person did (an operator, or a key from before this was recorded).

dashboardboolean

true for the account's built-in dashboard key: the dashboard's playground runs as it (so its requests are logged, counted and billed like any key's). Nobody holds its secret, so it works only from the signed-in dashboard. Only its spend_limit can be changed (to cap what the playground spends live); renaming, rescoping, restricting, rotating or revoking it is forbidden (details.reason dashboard_key). It is made on first use and revoked with the account.

expires_atstring date-timenullable

When the key stops working, RFC 3339 UTC; null when it never expires.

idstring

Key ID (key_…): manage the key with it. It is not the secret.

ip_allowliststring[]

IP addresses or CIDR ranges (IPv4 or IPv6) the key works from; [] = any.

last_used_atstring date-timenullable

About when the key was last used (updated at most hourly); null when never.

namestring

Your label for the key.

objectstring

Always api_key.

One ofapi_key

prefixstring

The secret's first characters, to recognize it.

previous_secret_expires_atstring date-timenullable

Until then the secret this key had before its last rotation works too (rotate_secret), RFC 3339 UTC; null when none does.

revoked_atstring date-timenullable

When the key was revoked; null while it is not.

scopesstring[]

What the key may call: endpoints (data endpoints), jobs (create, read and cancel jobs; includes jobs:read), jobs:read (read jobs and their results), account:read (account, usage, ledger, keys), admin (account settings and key management; includes account:read).

One ofendpointsjobsjobs:readaccount:readadmin

secretstring

The key itself: send it in the x-api-key header. Shown only once: store it now.

spend_limitobjectnullable

The key's spend limit and what it used this interval; null when the key has none.

statusstring

pending: created by an agent signup and waiting for the owner's email confirmation (it can only read GET /v1/account). expired: past expires_at.

One ofactivependingexpiredrevoked

objectstring

Always agent_signup.

One ofagent_signup

metaobject

The shared route meta (see the API reference introduction).

202

The address already has an account: no keys were made; its owner was emailed a sign-in link to create a key for you in the dashboard. Ask them to check their email.

dataobject
ShowHide 3 child fields
emailstring

Where the link was sent.

expires_atstring date-time

When the link stops working, RFC 3339 UTC.

objectstring

Always signup.

One ofsignup

metaobject

The shared route meta (see the API reference introduction).

400

400 Bad Request.

invalid_inputNo retry

A parameter is missing or malformed, or the link is not one this endpoint takes.

Fix the parameter named in param as the message says. For a link of the wrong kind, call an endpoint listed in details.endpoints, when there is one.

429

429 Too Many Requests.

rate_limitedYes, later

The account passed its runaway-protection ceiling: a high per-account limit that stops a broken client loop (plans have no rate limit). Requests without an API key (signup, the MCP server's tool listing and find_endpoint) are limited per IP address instead. It also stops an account whose failed requests in the last hour cost far more than its successful ones paid for: failures are free within a limit (the message says so), and successes raise it.

Wait the seconds in the retry-after header, then retry. If your steady traffic needs more, ask support to raise the ceiling; without an API key, send one.

operationId agent_signup.create