CorroborateMe

Let your app or AI assistant confirm who it's talking to. Works with any app or website, not just AI assistants.

Audiences

Backend / app - Bearer aa_... REST, plus login-link for your end users
Human operator - console Sign in at /login (platform login-link), manage companies & keys
Agent / automation - same REST, plus optional MCP tools at /mcp (API key or MCP OAuth)
Your customers - we host the sign-in page. People can use a password, an email code, Google, Apple, or a passkey.

1. Get credentials

Human path: register/login -> create company -> POST /api/companies/{id}/keys
Agent / script path: POST /api/agents/bootstrap with contact_email -> verify the emailed code -> pay (machine-pay / checkout) -> receive aa_...

curl -s https://corroborateme.com/api/config | jq .
curl -s -X POST https://corroborateme.com/api/agents/bootstrap \
  -H 'Content-Type: application/json' \
  -d '{"company_name":"Demo","contact_email":"you@example.com"}'
# 202 verification_required - check email for 6-digit code, then:
curl -s -X POST https://corroborateme.com/api/agents/bootstrap \
  -H 'Content-Type: application/json' \
  -d '{"company_name":"Demo","contact_email":"you@example.com","code":"123456"}'

2. Common integrations

Login-link - create a one-time sign-in link. Your app hears back when the person is done, in whichever way suits it (poll, SSE, webhook, redirect, form_post, or postMessage). Try it in the interactive API reference.
OIDC - register clients with POST /api/oidc/clients; revoke with POST /api/oidc/clients/{clientId}/revoke; discovery at /api/auth/.well-known/openid-configuration; JWKS at /api/auth/jwks. When customers sign in to your other apps, they use the same sign-in page.
Google and Apple sign-in - want Google or Apple sign-in under your own name? Add your Google or Apple details with /api/integrations and we store them encrypted. Sign-in page endpoints are documented under the Login-link IdP tag in Swagger.

Comparisons and guides

Hosted sign-in pricing compared. How hosted sign-in is usually priced, next to CorroborateMe's flat Pro plan. Passkeys included. Not billed per monthly active user.
Sign-in for MCP servers. Add sign-in to an MCP server with a CorroborateMe login link. Call the HTTP API or the create_login_link tool.
Sign-in for AI agent apps. Sign-in for GPT, Claude, Cursor, Grok Bot, and other agent apps. Same HTTP API and optional MCP. No official plugin.
Sign-in for Shopify apps. How a Shopify app backend can ask CorroborateMe who a person is, using the login-link HTTP API. No Shopify app is included.
Sign-in for Grok Bot agents. How a Grok Bot agent can confirm a person with CorroborateMe over HTTP or MCP. Not an official Grok partnership.
Authentication for AI agents. Create a CorroborateMe login link, send the URL to a person, and read back their user id. Curl and MCP for AI agents.
Passkey login API. Passkey sign-in on a CorroborateMe login link: the hosted page, plus the passkey options and verify endpoints.
Migrating from a hosted auth provider. Move from a hosted auth provider to CorroborateMe: a login link, one flat price, and an HTTP API. Not a drop-in SDK.
Grok Bot agent sign-in. Create a CorroborateMe sign-in link from a Grok Bot agent over HTTPS or MCP, then read the user id after the person signs in.

3. Agent discovery

Machines should start at /llms.txt (short) or /llms-full.txt (tools + flows). MCP descriptor: /.well-known/mcp.json. MCP OAuth PRM: /.well-known/oauth-protected-resource. Public MCP directories package (schema stub + install docs, not this Worker): https://github.com/CNR-Consulting/corroborate-me. Live MCP stays /mcp on this host. Humans should start here, at /pricing, or at /swagger.

Auth header

Authorization: Bearer aa_..._your_secret
# or console / company session JWT
# or MCP OAuth access token (aud = https://corroborateme.com/mcp)

Operator admin APIs are private and intentionally omitted from OpenAPI.