Questions we hear every day

Static keys never expire and live on your machine. If leaked, every service using that key is compromised. AgentOnboard exchanges a static key for a 5-minute session token. If a token leaks, it expires in minutes. If a key leaks, you revoke it once and access stops everywhere.

No. The agent authenticates once with your static key to get a session token, then presents that token to any partner API. The partner API calls AgentOnboard to verify the token. Your agent never talks to us during the actual API call.

Head to your dashboard and revoke it. That single action invalidates the key everywhere — no need to rotate credentials across every service your agent uses. You can generate a new key immediately.

Any API that has integrated with AgentOnboard. Browse the Partner Directory to see who's already on the network. If you run an API, you can integrate in minutes — your users' agents authenticate through us, so you don't need to build auth from scratch.

The core protocol and SDK are open source. The hosted service manages token verification, key revocation, and the partner directory. Check our GitHub for the source.

Sign up on the Partners site, integrate AgentOnboard verification into your API, and submit your listing. Once approved, every AgentOnboard user can call your API with a single session token.

No. One account, one static key per agent. You label each key so you know which agent is using it. Revoke an agent's key without affecting any others.

Free tier includes a generous daily token allowance. If your agents make heavy use, we offer a pro tier with higher limits and priority verification. No hard rate limits for paid plans.