generated: '2026-09-19'
method: searched
source: https://docs.algovoi.co.uk/api-reference/authentication
docs: https://docs.algovoi.co.uk/api-reference/authentication
spec: [openapi/algovoi-co-uk-gateway-openapi.yml, openapi/algovoi-co-uk-pay-openapi.yml, openapi/algovoi-co-uk-clinic-openapi.yml, openapi/algovoi-co-uk-agent-trust-bench-openapi.yml, openapi/algovoi-co-uk-audit-verifier-openapi.yml]
summary:
  types: [http-bearer, apiKey(header), payment-as-auth(x402), payment-as-auth(mpp), hmac-webhook-signature, session-token, none]
  api_key_in: [header]
  oauth2_flows: []
  transport: HTTPS only (TLS 1.3 at the Cloudflare edge, HSTS preload on every host probed)
  note: >-
    NONE of the five OpenAPIs declares components.securitySchemes or operation-level security — the gateway spec
    instead declares `authorization` and `x-tenant-id` as plain header parameters on 53 / 48 operations, and the
    pay spec declares `x-payment` as an optional header on paid operations. The authentication model therefore comes
    from the docs and from live probes, not the contracts; overlays/ adds the schemes as an enhancement. Four
    surfaces, four models: the tenant gateway is a static Bearer key plus a tenant selector; the pay rail has no
    credential at all (the on-chain payment presented in X-PAYMENT is the authorization); the clinic, the audit
    verifier and the Agent Trust Bench are anonymous; and the ulu MCP server gates tool calls with an x402 402.
    There is no OAuth 2.0, no OIDC and no dynamic client registration anywhere in the estate (every
    /.well-known/openid-configuration and oauth-* probe is 404/405).
schemes:
- id: tenant-api-key
  type: http
  scheme: bearer
  header: Authorization
  companion_header: X-Tenant-Id
  key_prefix: algv_
  applies_to: api.algovoi.co.uk (canonical) and the cloud.algovoi.co.uk proxy; the stdio MCP server and every framework adapter carry the same key
  description: >-
    "Authorization: Bearer <YOUR_API_KEY>" plus "X-Tenant-Id: <YOUR_TENANT_ID>" on every authenticated request; the
    key proves you may act, the tenant header selects which tenant. Keys are shown once at creation and stored
    one-way hashed. Keys are bound to a mode — test-mode keys reach testnet networks only, live-mode keys reach
    mainnet only after KYC — and cannot switch modes. Rotation: one click, old and new keys both valid for 30 days,
    then the old key is revoked.
  obtain: https://dash.algovoi.co.uk (Settings → API keys); trial accounts via https://dash.algovoi.co.uk/signup or https://api.algovoi.co.uk/signup
  observed: 'POST /v1/verify and GET /v1/customers without credentials → 401 {"detail":"Unauthorized"}; /a2a/jsonrpc and /extendedAgentCard likewise 401'
  errors: {401: invalid_api_key, 403: tenant_id_mismatch / missing scope, 422: kyb_required_for_mainnet}
  docs: https://docs.algovoi.co.uk/api-reference/authentication
- id: admin-control-plane-key
  type: http
  scheme: bearer
  header: Authorization
  key_prefix: algvc_
  applies_to: operator / control-plane endpoints
  scopes: [tenants:admin, apikeys:admin, kyb:write, live:activate, payments:read, audit:read]
  description: Admin keys carry a scope list; "most tenant integrations don't need admin keys at all". Two MCP tools (list_mpp_subscriptions, cancel_mpp_subscription) require an admin-scope key. Not OAuth scopes — no OAuthScopes artifact is emitted.
- id: agent-session-token
  type: http
  scheme: bearer
  header: Authorization
  applies_to: 'POST /auth/token (exchange_atb_cert_auth_token_post) and GET /auth/token/status (session_status_auth_token_status_get)'
  description: >-
    An agent exchanges an ATB ZKP certificate (X-ATB-ZK-Credential) or a federation token for a spend-capped
    session token, using normal API-key auth for that one request; the returned token is then presented as
    "Authorization: Bearer <token>" without X-Tenant-Id (tenant id is read from the token claims). 401 when invalid
    or expired.
  docs: https://docs.algovoi.co.uk/agent-session-auth
- id: mandate-jwt
  type: http
  scheme: bearer
  header: Authorization
  applies_to: 'POST /mandate/pay (mandate_pay_mandate_pay_post)'
  description: A mandate JWT is passed as a standard HTTP Bearer token; no X-Tenant-Id — mandate tokens are cross-tenant.
- id: x402-payment
  type: payment
  protocol: x402 (v2 on pay.algovoi.co.uk; v1 and v2 on api.algovoi.co.uk)
  header: X-PAYMENT
  challenge: 'HTTP 402 with a JSON accepts[] body and a base64 payment-required header; on the pay rail every 402 carries one accept per enabled lane with payTo, amount (10000 micro-USDC) and a 1800-second payment_reference challenge token'
  applies_to: 'pay.algovoi.co.uk /pay/v1/* (payment is the only credential), api.algovoi.co.uk /mpp/probe, /mpp/{resource_id}, /protected/{resource_id}, /r/{tenant}/{resource}, and mcp.algovoi.co.uk/mcp tool calls'
  description: >-
    "No API key/bearer. Each paid skill returns an x402 v2 402 challenge ... pay the USDC amount to payTo on your
    chosen lane, bound per that lane's scheme, then resubmit with the X-PAYMENT proof." Mined-tx lanes (Algorand,
    Voi, Stellar, Hedera, Solana, Tempo) weld the challenge into the tx note/memo/reference; EVM EIP-3009 lanes
    (Base, Monad, Polygon, Arbitrum, OP, Arc) accept a stock signed TransferWithAuthorization with an optional nonce
    weld. A2A over the same rail uses the a2a-x402 extension (payment-required task state).
  observed: 'GET https://pay.algovoi.co.uk/pay/v1/verify/receipt → 402, 13,977-byte accepts[] body, payment-required header; POST tools/list on mcp.algovoi.co.uk/mcp → 402 x402 v1 challenge'
  docs: https://docs.algovoi.co.uk/algovoi-pay
- id: mpp-payment
  type: payment
  protocol: MPP (Machine Payments Protocol) — HTTP "Payment" authentication scheme
  header: 'WWW-Authenticate: Payment (challenge) / PAYMENT-SIGNATURE (proof, declared as a header parameter in the gateway spec)'
  applies_to: 'api.algovoi.co.uk /mpp/* and /mpp/sub/*'
  observed: 'GET https://api.algovoi.co.uk/mpp/probe → 402 with WWW-Authenticate: Payment realm="api.algovoi.co.uk", id="algovoi-mpp-probe-static-v1", method="tempo", intent="charge", expires=..., request=<base64>'
- id: webhook-signature
  type: hmac
  header: X-AlgoVoi-Signature
  key_prefix: algvw_
  algorithm: 'HMAC-SHA256 over "{t}.{raw_body}"; header format t={unix_ts},v1={hex}; ±300 s tolerance; constant-time compare; 30-day dual-secret rotation window'
  direction: inbound to the tenant (AlgoVoi signs outbound webhooks)
  docs: https://docs.algovoi.co.uk/integrations/outbound-webhooks
- id: reputation-credentials
  type: apiKey
  in: header
  name: X-ATB-Credential / X-ATB-ZK-Credential
  applies_to: 'Optional on payment-gated gateway operations (declared as header parameters); presenting a valid Falcon-1024 or Bulletproofs ATB Pass Certificate earns a 20% discount on the challenge amount'
  docs: https://docs.algovoi.co.uk/atb-reputation-credential
- id: anonymous
  type: none
  applies_to: 'agents.algovoi.co.uk (clinic REST, A2A and MCP), verify.algovoi.co.uk (audit verifier), agent-trust-bench.algovoi.co.uk (/freebie, /discovery/resources, /stats.json; profiles answer 402), pay.algovoi.co.uk free tiers (/v1/receipt/verify 120/min, /verify/rfc9421 60/min), api.algovoi.co.uk /health, /compliance/attestation, /discovery/resources, /.well-known/*'
  description: Public, no credential; abuse control is per-IP rate limiting.
per_api:
  algovoi-pay-payable-core-api: [x402-payment, anonymous]
  algovoi-gateway-api: [tenant-api-key, admin-control-plane-key, agent-session-token, mandate-jwt, x402-payment, mpp-payment, reputation-credentials, webhook-signature]
  algovoi-rfc9421-clinic-api: [anonymous]
  algovoi-agent-trust-bench-api: [anonymous, x402-payment]
  algovoi-audit-verifier-api: [anonymous]
  algovoi-mcp-server: [anonymous (agents.algovoi.co.uk/mcp), x402-payment (mcp.algovoi.co.uk/mcp), tenant-api-key (stdio package via ALGOVOI_API_KEY)]