# Hexclave authentication for agents

## Discover

Read the Hexclave documentation at https://docs.hexclave.com and the API reference at https://docs.hexclave.com/api-reference. Hexclave currently authenticates integrations with API keys issued from the dashboard. This page follows the WorkOS auth.md draft vocabulary so an agent can understand the intended discovery model.

RFC 9728 oauth-protected-resource metadata and RFC 8414 oauth-authorization-server metadata are not yet published by Hexclave. There is therefore no live metadata URL or WWW-Authenticate resource_metadata challenge to follow today.

## Pick a method

For a server integration, use a dashboard-issued API key with the smallest required permissions. Hexclave does not currently advertise anonymous credentials or an identity_assertion / id-jag exchange for this website API.

## Register

Create or manage a Hexclave project from https://app.hexclave.com. The dashboard is the current registration surface: create an API key with only the permissions needed for the task. A future agent_auth metadata document may advertise a register_uri, but Hexclave does not publish one yet.

## Claim

After creating a key, copy it when the dashboard presents it and store it in the server's secret manager. Hexclave does not currently publish a separate claim_uri or token-exchange endpoint.

## Use the credential

Send the key using the authorization format documented for the endpoint. Prefer the official SDKs and follow the API reference for request schemas, scopes, and environment-specific URLs. Treat credentials as secrets and rotate them if exposed. If an API endpoint returns a future WWW-Authenticate header pointing at oauth-protected-resource metadata, follow that server's current instructions rather than assuming this page has OAuth support.

## Errors

Handle 401 and 403 responses as authentication or permission failures. Validate request data against the API schema, respect rate limits, and retry only safe, idempotent requests.

## Revocation

Revoke compromised or obsolete keys from the Hexclave dashboard, then issue a replacement with narrower permissions. A future agent_auth document may advertise a revocation_uri; no standalone revocation endpoint is published today. For current credential lifecycle details, see https://docs.hexclave.com.

See the WorkOS auth.md draft for the discovery vocabulary: https://workos.com/auth-md.