---
title: Authentication
canonical: https://seminalysisgoesagentic.swarmlabs.eu/auth.md
---
# Authentication

## Get a demo key

```bash
curl -X POST https://seminalysisgoesagentic.swarmlabs.eu/api/v1/agent/subscribe -H "Idempotency-Key: my-key"
```

Response:

```json
{ "status": "demo", "api_key": "sa_demo_...", "scopes": ["articles:read","mcp:connect"],
  "mcp_endpoint": "https://seminalysisgoesagentic.swarmlabs.eu/mcp", "docs": "/auth.md",
  "message": "no payment processed" }
```

## Use the key

```bash
curl https://seminalysisgoesagentic.swarmlabs.eu/api/v1/articles/<slug> -H "Authorization: Bearer sa_demo_..."
```

## Scopes

| Scope | Grants |
|---|---|
| `articles:read` | Read paid article bodies via the API |
| `mcp:connect` | Connect the MCP server and call tools |

## OAuth 2.0

This is a mock authorization server for discovery compliance.

- AS metadata: [`/.well-known/oauth-authorization-server`](/.well-known/oauth-authorization-server)
- OpenID config: [`/.well-known/openid-configuration`](/.well-known/openid-configuration)
- Protected resource: [`/.well-known/oauth-protected-resource`](/.well-known/oauth-protected-resource)
- PKCE: `code_challenge_methods_supported: ["S256"]`
- Agent auth: [`/agent/auth`](/agent/auth)

Missing or invalid tokens on protected paths return `401` with
`WWW-Authenticate: Bearer resource_metadata="https://seminalysisgoesagentic.swarmlabs.eu/.well-known/oauth-protected-resource"`.