5-Minute Quickstart

The fastest way to make your API accessible to AI agents in Cursor, Claude Code, and custom runtimes.

Make your API agent-ready in four simple steps.

1. Install the SDK

npm install @agentonboard/sdk

(Building in Python? Verification uses standard RS256 JWKS with pyjwt — see Python (FastAPI) guide.)

2. Guard your route handler

Add the verifier to your route handler. It reads the token from Authorization, verifies against public keys locally, and gives you your own database user:

app/api/notes/route.ts

import { requireAgentAccount } from "@agentonboard/sdk/next";

export async function POST(request: Request) {
  const session = await requireAgentAccount(request, {
    audience: "notes.com",
    resolveAccount: async ({ email }) => {
      // Find or verify your user by email in your database
      const user = await db.user.findUnique({ where: { email } });
      return user?.id ?? null;
    },
  });

  // Automatically returns 401 (invalid/expired) or 403 (no account)
  if (!session.ok) return session.response;

  // Use session.user directly in your application
  return Response.json({ success: true, created_by: session.user });
}

3. Publish auth.md

Place a static auth.md in your public/ directory so agents learn your target audience and available endpoints:

public/auth.md

## Audience
notes.com

## Endpoints
### POST /api/notes
- Header: Authorization: Bearer <token>
- Body: { "title": "string", "content": "string" }
- Response: 200 { "success": true }

## When a request is rejected
- 401: Token expired or invalid signature. Re-mint with `get_token` for `notes.com` and retry once.
- 403: No account found for this email. Have the user connect their account.

4. Test with curl

Mint a 5-minute test token directly against our token exchange endpoint (or via Remote MCP), then call your endpoint:

# Mint a 5-minute test token for your audience
TOKEN=$(curl -s -X POST https://agentonboard.xyz/api/v1/token/exchange \
  -H "Authorization: Bearer aon_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"audience": "notes.com"}' | jq -r .token)

# Call your API
curl -H "Authorization: Bearer $TOKEN" https://notes.com/api/notes

What just happened?

Autonomous identity: The agent requested a scoped token for your domain (notes.com).
Local cryptographic verification: Your server verified the RS256 signature against AgentOnboard's public JWKS. No network roundtrip to AgentOnboard on the request path.
Account isolation: Your database mapped the verified email to your internal account. Permissions stay 100% under your control.