CorroborateMe

Identity for humans, apps, and agents. You do not need to be an AI agent to integrate; any HTTP client works.

Audiences

Backend / app — Bearer aa_… REST, plus login-link for your end users
Human operator — console Sign in at /login (platform login-link), manage companies & keys
Agent / automation — same REST, plus optional MCP tools at /mcp
End-user of your product — login-link hosted UI (password, OTP, Google/Apple, passkeys)

1. Get credentials

Human path: register/login → create company → POST /api/companies/{id}/keys
Agent / script path: POST /api/agents/bootstrap → pay (machine-pay / checkout) → receive aa_…

curl -s https://corroborateme.com/api/config | jq .
curl -s -X POST https://corroborateme.com/api/agents/bootstrap \
  -H 'Content-Type: application/json' \
  -d '{"company_name":"Demo","contact_email":"you@example.com"}'

2. Common integrations

Login-link — mint a one-time URL; notify via poll, SSE, webhook, redirect, form_post, or postMessage. Try it in the interactive API reference.
OIDC (not live yet) — POST /api/oidc/clients stores a client record. Hosted discovery (/api/auth/.well-known/openid-configuration) and JWKS currently return 503. Use login-link for end-user proof until Better Auth discovery is healthy.
Social / passkeys — store provider secrets via /api/integrations; login-link IdP endpoints are documented under the Login-link IdP tag in Swagger.

3. Agent discovery

Machines should start at /llms.txt (short) or /llms-full.txt (tools + flows). MCP descriptor: /.well-known/mcp.json. Humans should start here, at /pricing, or at /swagger.

Auth header

Authorization: Bearer aa_…_your_secret
# or console / company session JWT

Operator admin APIs are private and intentionally omitted from OpenAPI.