# auth.md — Authenticate with Arbol (agent_auth)

How AI agents obtain credentials for the Arbol public API on **apib.getarbol.com**.

Keywords: agent_auth, WWW-Authenticate, resource_metadata, authentication service, API key.

## Access first

Arbol registration is **closed**. An organization receives dashboard access after a demo and onboarding. Custom fixed monthly pricing in COP.

Humans: https://www.getarbol.com/registro or https://www.getarbol.com/contact

## Discover

1. Protected-resource metadata (www + API host):
   - `https://www.getarbol.com/.well-known/oauth-protected-resource`
   - `https://apib.getarbol.com/.well-known/oauth-protected-resource`
2. API catalog (RFC 9727):
   - `https://www.getarbol.com/.well-known/api-catalog`
3. On 401 from `https://apib.getarbol.com/api/v1`, read:
   - `WWW-Authenticate: Bearer resource_metadata="https://apib.getarbol.com/.well-known/oauth-protected-resource"`

## Credential

After org access is granted:

Use an **organization API key** as `Authorization: Bearer ak_…`. The key is opaque, scoped, and revocable in the authentication service.

## Register / Claim

All API-key lifecycle operations are owned by the **authentication service**. Arbol stores no copy or hash of an API key. Public API keys must have an organization as their subject.

## Use the credential

Call `https://apib.getarbol.com/api/v1/…` with:

`Authorization: Bearer <api_key>`

OpenAPI: https://apib.getarbol.com/openapi.json

## Errors

Unauthenticated entry points return **401** with `WWW-Authenticate` pointing at the protected-resource metadata URL above.

## Revocation

- API keys: revoked in the authentication service by an authorized organization administrator.

## Not available

- Anonymous API access without org onboarding
- Self-serve signup
- MCP server (Arbol does not operate an MCP endpoint)