Questions every provider asks

One verify call. Drop in the AgentOnboard SDK (or call POST /api/verify directly), and when an agent presents a session token, you verify it through AgentOnboard before letting it act. Most providers ship this in under an hour.

Your user's agent authenticates through AgentOnboard and receives a short-lived session token. When the agent calls your API, it presents that token. You make a single verify call to AgentOnboard and get back who the agent represents. Then your API does what it normally does — we're not in the request path.

Nothing during early access. Integration, verification, and your directory listing are free — no credit card required. We'll announce pricing before anything changes.

No. Your users never hand you a static key. Agents present short-lived session tokens, and you verify them through AgentOnboard. There is no key for you to store, leak, or rotate.

Session tokens are short-lived — they expire in minutes, not months. If one leaks, it's worthless almost immediately. Your users' agents re-authenticate automatically, so there's no maintenance on your side.

No. We verify identity; we never proxy traffic. Your agent's API call goes directly from the agent to your platform. AgentOnboard is only consulted for the verify call.

We see the identity your user's agent presents when it authenticates — the email tied to their AgentOnboard account — and that the agent holds a valid session. We don't see the contents of your API requests or responses, and we don't store your users' data.

Your dashboard shows every interaction: which agent called, on behalf of which user, how often, and whether it succeeded. You also get a per-request audit log, so you can answer 'who did this and when' for any agent action.

Sign up, integrate the verify call, then submit your listing from your dashboard. Once approved, your API is discoverable by every AgentOnboard user — and callable by any agent with a session token.

Keep it. AgentOnboard is additive — agents can authenticate through us alongside your existing human auth. You get agent-native access without ripping out anything that works.

A technical founder can integrate in under an hour: one SDK, one verify call, one test against the sandbox. No OAuth flows, no key management, no per-user setup.