Authentication

Programmatic access uses a two-step flow: exchange your org API key for a short-lived JWT, then call the agent API with that JWT.

Step 1 — Create an API key

Go to Console → Settings → Security
Click New API Key
Copy the key — it is only shown once

Org API keys start with sk_live_ and look like: sk_live_abc123xyz789...

Step 2 — Exchange for a JWT

POST https://profile-api.auteryn.ai/api/v1/auth/exchange/agent-token
X-API-Key: sk_live_your_key
Content-Type: application/json

{
  "agent_id": "your-agent-uuid"
}

Response:

{
  "access_token": "eyJ...",
  "token_type": "bearer",
  "expires_in": 3600
}

The JWT expires in 1 hour. Exchange again when it expires.

For member-scoped access (acting as a specific org user), use POST /api/v1/auth/exchange/member-token instead.

Step 3 — Call the agent API

Authorization: Bearer eyJ...
X-Agent-Id: your-agent-uuid
Content-Type: application/json

Agent API base URL: https://agent-api.auteryn.ai

curl -X POST https://agent-api.auteryn.ai/api/run \
  -H "Authorization: Bearer eyJ..." \
  -H "X-Agent-Id: agent_xyz789" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [{"role": "user", "content": "Summarize the open GitHub issues"}],
    "stream": false
  }'

Find your agent’s ID in Console → Agents → [your agent] → Settings.

Browser sessions

When using the Console or Workspace in a browser, authentication uses the auth_session cookie (JWT issued at login). You do not need an API key for in-app chat.

Security

API keys are org-scoped
Always use HTTPS — never send keys over plain HTTP
Store keys in environment variables, not in source code
Rotate keys if compromised: Settings → API Keys → Revoke

Error responses

Status	Meaning
`401`	Missing or invalid API key or JWT
`403`	Token valid but no access to this resource
`429`	Too many requests — slow down