ecentic API authentication.

Every endpoint under /api/v1 answers without an Authorization header, as do the well-known discovery documents, the OpenAPI document, and the MCP list_plans tool. An agent can learn the whole shape of the API — endpoints, plans, protocols, skills, rate limits, error codes — before anyone has created an account.

The sandbox is open too: POST /api/v1/sandbox/simulation returns the exact response shape of a real simulation, computed from synthetic scoring, so a client can be written and tested with no credential at all.

Create an account, then mint a key either from the dashboard or by calling the create_api_key MCP tool from an authenticated session. Keys look like ecentic_sk_…, are long-lived, and are shown exactly once — ecentic stores only a hash, so a lost key is replaced rather than recovered.

Rotate by minting a new key and revoking the old one. Nothing about the process requires contacting a human.

Send the key as a bearer token on every protected request. The same header works on the REST surface and on MCP tool calls.

Do not put the key in a query string: query strings end up in logs, proxies, and referrer headers, and ecentic will not read one from there.

A missing or invalid credential returns HTTP 401 with a WWW-Authenticate header naming the Protected Resource Metadata document (RFC 9728). Following it leads to the authorization server metadata (RFC 8414), so a client that hits a 401 can discover how to authenticate without a human reading documentation.

On the REST surface the body is an RFC 9457 problem with code: "unauthenticated". On the MCP endpoint it is a JSON-RPC error with code -32001 and a resource_metadata hint in error.data.