---
title: zer0dev agent authentication
description: How agents obtain zer0dev install keys and OAuth tokens.
canonical: https://zer0dev.vercel.app/auth.md
last-updated: 2026-09-18T07:27:21.683Z
---

# zer0dev agent authentication

How autonomous agents and IDE integrations obtain credentials for the zer0dev hosted API.

## Discover

- OAuth authorization server (RFC 8414): `https://zer0dev.vercel.app/.well-known/oauth-authorization-server`
- OAuth protected resource (RFC 9728): `https://zer0dev.vercel.app/.well-known/oauth-protected-resource`
- OpenAPI catalog: `https://zer0dev.vercel.app/api/openapi`
- Onboarding JSON: `https://zer0dev.vercel.app/api/public/onboarding`

## Pick a method

| Method | When to use |
| --- | --- |
| **Install key (Bearer)** | IDE sessions after human sign-in — preferred for builders |
| **OAuth client_credentials** | Agents exchanging `zd_live_*` install key at the token endpoint |

zer0dev does **not** offer anonymous access to content routes. Public routes (`/api/health`, `/api/openapi`, onboarding, capabilities) require no credential.

## Register

**Students:** open `https://zer0dev.vercel.app/login`, complete magic link. New accounts need a school email that ends in .edu.

**Non-students testing:** contact the author via [LinkedIn](https://www.linkedin.com/in/zer0dev/) — no payment required.

`register_uri`: `https://zer0dev.vercel.app/login`

## Claim

After sign-in:

1. Open `https://zer0dev.vercel.app/boot` and install Boot into the IDE.
2. Create an install key (`zd_live_…`) at `https://zer0dev.vercel.app/settings`. Shown once.
3. Use `Authorization: Bearer <install_key>` on content routes, or exchange the key at `POST https://zer0dev.vercel.app/api/oauth/token`.

`claim_uri`: `https://zer0dev.vercel.app/settings`

## Use the credential

```http
GET https://zer0dev.vercel.app/api/boot HTTP/1.1
Authorization: Bearer zd_live_…
Accept: text/markdown
```

Token exchange:

```http
POST https://zer0dev.vercel.app/api/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_secret=zd_live_…&scope=content:read audit:write
```

Scopes are listed in protected-resource metadata and OpenAPI `securitySchemes.oauth2`.

## Errors

| Status | Meaning |
| --- | --- |
| `401` | Missing or invalid Bearer / install key |
| `403` | Valid session but not allowed for this route |
| `404` | Unknown skill or module id |

Responses do not include secret values or stack traces.

## Revocation

Revoke install keys in `https://zer0dev.vercel.app/settings`. Revoked keys fail token exchange and Bearer checks.

`revocation_uri`: `https://zer0dev.vercel.app/settings`

---

Keywords: `agent_auth`, `register_uri`, `identity_assertion`, `WWW-Authenticate`, install key, client_credentials.