generated: '2026-09-19'
method: searched
docs:
- https://api.babyblueviper.com/guide
- https://api.babyblueviper.com/wallet-onboarding
- https://api.babyblueviper.com/llms.txt
- https://api.babyblueviper.com/.well-known/oauth-authorization-server
- https://api.babyblueviper.com/.well-known/agent-card.json
source: >-
  The OpenAPI (openapi/babyblueviper-com-openapi.yml) declares NO components.securitySchemes — 167 of 187
  operations carry security: [] and the paid ones carry an x-payment-info block instead of a scheme — so
  derive-authentication.py produced nothing. This profile is written from the provider's payment guide,
  wallet-onboarding page, llms.txt, the RFC 8414/9728 metadata, the agent card's securitySchemes block and
  live 402/401 responses observed on 2026-09-19.
summary:
  types: [http-bearer, l402, x402, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  default: Bearer api_key (free registration; the provider's recommended path for agents)
  note: >-
    Four ways in. (1) Bearer: POST /register (no payment, no wallet) returns an api_key prefixed ivv_ ; send
    Authorization: Bearer <api_key>; the first few paid calls are free ("first 5 calls FREE" in the live 402
    body; "free_calls_remaining" in review responses), after which the balance must be funded via Lightning
    top-up, x402 USDC or card. (2) L402: an unauthenticated POST to a paid endpoint returns 402 with
    WWW-Authenticate: L402 token="...", invoice="lnbc..." — pay the bolt11 invoice and retry with
    Authorization: L402 <payment_hash>:<preimage>. (3) x402: send X-Payment-Scheme: x402 (or hit an
    x402-priced GET such as /regime) to receive a 402 whose payment-required header carries a base64 x402
    v2 challenge (accepts[]: scheme exact, network eip155:8453, USDC asset, payTo, amount) and whose body is
    the same JSON; retry with an X-PAYMENT header. (4) OAuth 2.1 for the MCP resource: RFC 8414 metadata at
    /.well-known/oauth-authorization-server (authorization_code + refresh_token, PKCE S256, dynamic client
    registration, scope mcp). No OpenID Connect (the openid-configuration path says so explicitly).
schemes:
- name: bearer
  type: http
  scheme: bearer
  key_prefix: ivv_
  obtain: 'POST https://api.babyblueviper.com/register {"label": "my-agent"} (free, instant, no wallet)'
  header: 'Authorization: Bearer <api_key>'
  applies_to: every paid REST endpoint and every paid MCP tool call; also account endpoints (/balance takes api_key as a query parameter instead)
  sources: [agent card securitySchemes.bearer, https://api.babyblueviper.com/guide, live 402 body "recommended_path"]
  observed: 'POST /memory/store without credentials -> 401 {"detail":"Missing or invalid Bearer token (or send X-Payment-Scheme: x402 for USDC payment)"}'
- name: l402
  type: apiKey
  in: header
  parameter: Authorization
  format: 'L402 <payment_hash>:<preimage>'
  challenge: 'HTTP 402 with WWW-Authenticate: L402 token="<hex>", invoice="<bolt11>" and Retry-After: 15'
  applies_to: pay-per-call without a registered account (Lightning)
  sources: [agent card securitySchemes.l402, llms.txt "Payment methods", live POST /reason and POST /review 402 responses]
- name: x402
  type: apiKey
  in: header
  parameter: X-PAYMENT
  opt_in_header: 'X-Payment-Scheme: x402'
  challenge: 'HTTP 402 with x-payment-scheme: x402, a base64 payment-required header (x402Version 2, accepts[] on eip155:8453 USDC) and the same JSON in the body'
  network: eip155:8453 (Base), USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913; XRP Ledger also named in llms.txt/README
  catalog: https://api.babyblueviper.com/discovery/x402 (x402Version 2, 20 priced resources) and x-payment-info on 20 OpenAPI operations
  sources: [agent card securitySchemes.x402, OpenAPI info.x-guidance, live GET /regime and GET /signals/full 402 responses]
- name: oauth2
  type: oauth2
  resource: https://api.babyblueviper.com/mcp
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.babyblueviper.com/oauth/authorize
    tokenUrl: https://api.babyblueviper.com/oauth/token
    refresh: true
    pkce: [S256]
    scopes: {mcp: Access the invinoveritas MCP server}
  registration_endpoint: https://api.babyblueviper.com/oauth/register
  token_endpoint_auth_methods: [none, client_secret_post]
  client_id_metadata_document_supported: true
  metadata: https://api.babyblueviper.com/.well-known/oauth-authorization-server
  protected_resource_metadata: https://api.babyblueviper.com/.well-known/oauth-protected-resource
  sources: [RFC 8414 metadata, RFC 9728 metadata, MCP server card ("advertises OAuth2.1" per the provider roadmap)]
  note: No jwks_uri is published and no OIDC. Scopes are documented in scopes/babyblueviper-com-scopes.yml.
free_surface:
  note: Operations marked security [] in the spec that are genuinely free with no credential — /verify-proof, /ledger*, /conformance*, /health, /prices, /stats, /discovery/x402, /signals (teaser), the *-preview GETs, /offers/list, /messages/feed, the well-known documents and the docs pages.
x-evidence:
  fetched: '2026-09-19'
  probes:
  - {url: 'https://api.babyblueviper.com/reason', method: POST, status: 402, www_authenticate: L402, retry_after: 15}
  - {url: 'https://api.babyblueviper.com/review', method: POST, status: 402, www_authenticate: L402, amount_sats: 260}
  - {url: 'https://api.babyblueviper.com/regime', method: GET, status: 402, x_payment_scheme: x402}
  - {url: 'https://api.babyblueviper.com/memory/store', method: POST, status: 401}
  - {url: 'https://api.babyblueviper.com/balance', method: GET, status: 422, note: 'api_key query parameter required'}
  - {url: 'https://api.babyblueviper.com/.well-known/oauth-authorization-server', status: 200}