Authentication for AI agents

How to let an AI agent confirm who it's talking to, using CorroborateMe's sign-in API. Pro is $5.99 a month or $55 a year.

1. Get an API key

A human can sign in at /login, create a company, and mint a key. A script can call POST /api/agents/bootstrap with company_name and contact_email, then call it again with the emailed code. Billing is required before login links work. Pro is $5.99 a month or $55 a year, or prepaid $5.99 for 30 days. The docs show the bootstrap curl.

2. Ask the person to sign in

This call needs an active Pro plan. Without one it returns 402. POST /api/login-links with the company API key (aa_). Polling and server-sent events work with no extra setup. The default lifetime is 900 seconds.

curl -s -X POST https://corroborateme.com/api/login-links \
  -H "Authorization: Bearer aa_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state":"job-42"}'

The response includes sessionId and loginUrl. Show loginUrl to the person. It opens the hosted sign-in page.

Read who signed in

curl -s https://corroborateme.com/api/login-links/SESSION_ID \
  -H "Authorization: Bearer aa_YOUR_KEY"

Replace SESSION_ID with sessionId from the create call. status is pending, completed, consumed, or expired. user_id (a cu_ id) and email are present after the person finishes, and null while the link is still pending.

To wait instead of polling, open GET /api/login-links/{id}/events. It streams for about 25 seconds and ends with a pending or done event.

JavaScript

const created = await fetch("https://corroborateme.com/api/login-links", {
  method: "POST",
  headers: {
    Authorization: "Bearer aa_YOUR_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ state: "job-42" }),
}).then((r) => r.json());

// created.sessionId, created.loginUrl
// Show loginUrl to the person, then:

const status = await fetch(
  "https://corroborateme.com/api/login-links/" + created.sessionId,
  { headers: { Authorization: "Bearer aa_YOUR_KEY" } },
).then((r) => r.json());
// status.status, status.user_id, status.email

3. Optional MCP

{
  "mcpServers": {
    "corroborate-me": {
      "url": "https://corroborateme.com/mcp",
      "headers": {
        "Authorization": "Bearer aa_YOUR_KEY"
      }
    }
  }
}

create_login_link accepts state, and returns sessionId and loginUrl. get_login_status takes session_id. Claude, ChatGPT, Cursor, and Grok Bot can use this only if that product can call HTTPS or attach this MCP server. Cursor's local example file is .cursor/mcp.json.example. There is no official plugin for any of those products.

Hosts that discover OAuth themselves can read /.well-known/oauth-protected-resource and /.well-known/mcp.json.

Grok Bot notes: Grok Bot agent sign-in.