# Sign up as an agent: a key that works on confirm

Signup

POST `/v1/agent_signup`

Deprecated: agents follow /auth.md instead, which emails nobody and also works for an existing account. Send your human's email address and get a key that stays pending until the human confirms by email, which grants the free credits. Agents never get spending power without a human. For an address that already has an account, no keys are made: the owner is emailed a sign-in link to create one in the dashboard, and the answer is 202 with the human signup's object (check your email).

**Auth:** none.

## Example

cURL:

```shell
curl -X POST 'https://socialtap.dev/v1/agent_signup' \
  -H "content-type: application/json" \
  -d '{
  "email": "string"
}'
```

## Authorizations

No API key: anyone may call it.

## Body

JSON. Fields marked nullable may be `null`; optional ones may be left out.

| Field | Type | Description |
| --- | --- | --- |
| `email` | `string` | Your human's email address: they confirm there before the live key works. |
| `name?` | `string` | Your name as an agent, shown to the human and used as the keys' label: at most 40 ASCII letters, digits, spaces, hyphens, underscores or parentheses, starting with a letter or digit (anything else is invalid_input). Default: "Agent". |

## Response

### 201

Sign up as an agent: a key that works on confirm

| Field | Type | Description |
| --- | --- | --- |
| `data` | `object` |  |
| `data.account_id` | `string` | The new account (unverified until the human confirms). |
| `data.confirmation_expires_at` | `string` (date-time) | When the confirmation link stops working; then sign up again. |
| `data.email` | `string` | Where the confirmation link was sent. |
| `data.free_credits` | `integer` | Credits the account gets when the human confirms. |
| `data.live_key` | `object` | Pending until the human confirms by email; until then it can only read GET /v1/account (poll api_key.status). |
| `data.live_key.created_at` | `string` (date-time) | When the key was created, RFC 3339 UTC. |
| `data.live_key.created_by_key` | `string` or `null` | The API key (key_…) that last created this key, gave it the admin scope or rotated it: revoking that key also revokes this one if this one has admin. Null when none did, or a person has rotated it in the dashboard since. |
| `data.live_key.created_by_user` | `string` or `null` | The person (GET /v1/members user_id) who created this key in the dashboard, or whose key created it. They may have left the account since. Null when no person did (an operator, or a key from before this was recorded). |
| `data.live_key.dashboard` | `boolean` | true for the account's built-in dashboard key: the dashboard's playground runs as it (so its requests are logged, counted and billed like any key's). Nobody holds its secret, so it works only from the signed-in dashboard. Only its spend_limit can be changed (to cap what the playground spends live); renaming, rescoping, restricting, rotating or revoking it is forbidden (details.reason dashboard_key). It is made on first use and revoked with the account. |
| `data.live_key.expires_at` | `string` (date-time) or `null` | When the key stops working, RFC 3339 UTC; null when it never expires. |
| `data.live_key.id` | `string` | Key ID (key_…): manage the key with it. It is not the secret. |
| `data.live_key.ip_allowlist` | `string[]` | IP addresses or CIDR ranges (IPv4 or IPv6) the key works from; \[\] = any. |
| `data.live_key.last_used_at` | `string` (date-time) or `null` | About when the key was last used (updated at most hourly); null when never. |
| `data.live_key.name` | `string` | Your label for the key. |
| `data.live_key.object` | `string` | Always api_key.<br>One of `api_key` |
| `data.live_key.prefix` | `string` | The secret's first characters, to recognize it. |
| `data.live_key.previous_secret_expires_at` | `string` (date-time) or `null` | Until then the secret this key had before its last rotation works too (rotate_secret), RFC 3339 UTC; null when none does. |
| `data.live_key.revoked_at` | `string` (date-time) or `null` | When the key was revoked; null while it is not. |
| `data.live_key.scopes` | `string[]` | What the key may call: endpoints (data endpoints), jobs (create, read and cancel jobs; includes jobs:read), jobs:read (read jobs and their results), account:read (account, usage, ledger, keys), admin (account settings and key management; includes account:read).<br>One of `endpoints`, `jobs`, `jobs:read`, `account:read`, `admin` |
| `data.live_key.secret` | `string` | The key itself: send it in the x-api-key header. Shown only once: store it now. |
| `data.live_key.spend_limit` | `object` or `null` | The key's spend limit and what it used this interval; null when the key has none. |
| `data.live_key.status` | `string` | pending: created by an agent signup and waiting for the owner's email confirmation (it can only read GET /v1/account). expired: past expires_at.<br>One of `active`, `pending`, `expired`, `revoked` |
| `data.object` | `string` | Always agent_signup.<br>One of `agent_signup` |
| `meta` | `object` | The shared route meta (see the API reference introduction). |

### 202

The address already has an account: no keys were made; its owner was emailed a sign-in link to create a key for you in the dashboard. Ask them to check their email.

| Field | Type | Description |
| --- | --- | --- |
| `data` | `object` |  |
| `data.email` | `string` | Where the link was sent. |
| `data.expires_at` | `string` (date-time) | When the link stops working, RFC 3339 UTC. |
| `data.object` | `string` | Always signup.<br>One of `signup` |
| `meta` | `object` | The shared route meta (see the API reference introduction). |

### 400

400 Bad Request.

| Code | HTTP | Retry | Meaning | What to do |
| --- | --- | --- | --- | --- |
| `invalid_input` | 400 | No | A parameter is missing or malformed, or the link is not one this endpoint takes. | Fix the parameter named in param as the message says. For a link of the wrong kind, call an endpoint listed in details.endpoints, when there is one. |

### 429

429 Too Many Requests.

| Code | HTTP | Retry | Meaning | What to do |
| --- | --- | --- | --- | --- |
| `rate_limited` | 429 | Yes, later | The account passed its runaway-protection ceiling: a high per-account limit that stops a broken client loop (plans have no rate limit). Requests without an API key (signup, the MCP server's tool listing and find_endpoint) are limited per IP address instead. It also stops an account whose failed requests in the last hour cost far more than its successful ones paid for: failures are free within a limit (the message says so), and successes raise it. | Wait the seconds in the retry-after header, then retry. If your steady traffic needs more, ask [support](mailto:support@socialtap.dev) to raise the ceiling; without an API key, send one. |

operationId `agent_signup.create`

---

[HTML version](https://socialtap.dev/docs/reference/signup/agent-signup-create/) · [Docs index for AI agents](https://socialtap.dev/llms.txt) · [All docs in one file](https://socialtap.dev/llms-full.txt)