# Authentication

The Experiential Labs gateway uses organization-scoped API keys, not OAuth.

## Getting a key

1. A human signs in at https://platform.experientiallabs.ai/signin.
2. Mint a key at https://platform.experientiallabs.ai/settings/api-keys. The secret (`xpl_` + 40 hex
   chars) is shown exactly once. Keys are scoped to one organization.
3. Key creation and revocation are web-session actions. An API key cannot mint
   or revoke keys.

## Using a key

Send one header on every request:

    Authorization: Bearer xpl_...

- Inference (OpenAI-compatible): base URL https://api.experientiallabs.ai/v1
- Management API (catalog, usage, provider connections): https://api.experientiallabs.ai/api
- OpenAPI document: https://api.experientiallabs.ai/openapi.json
- Bad or missing key: HTTP 401 with `{"error":{"code":"invalid_key"}}`

## Agent registration

There is no self-service agent registration endpoint. An agent receives a key
from the human who minted it; the full flow is in https://platform.experientiallabs.ai/llms.txt and
https://platform.experientiallabs.ai/docs/authentication.