# SBC agent authentication

How AI agents and autonomous clients authenticate to SBC paymaster and bundler APIs.

## Discover

- OpenAPI: `http://localhost:3000/openapi.json`
- API catalog: `http://localhost:3000/.well-known/api-catalog`
- Human docs: https://docs.stablecoin.xyz/account-abstraction/direct-integration
- LLM index: `http://localhost:3000/llms.txt`

## Pick a method

SBC RPC uses **API key in URL path** (not OAuth). Pattern:

```
https://api.aa.stablecoin.xyz/rpc/v1/{chain}/{apiKey}
```

- `chain` — viem chain id (`base`, `baseSepolia`, `radius`, `radiusTestnet`, …)
- `apiKey` — secret from the SBC dashboard

x402 micropayments are available for HTTP-gated APIs via the [x402 SDK](https://docs.stablecoin.xyz/x402/sdk) and [facilitator](https://x402.stablecoin.xyz/).

## Register

1. Open [dashboard.stablecoin.xyz](https://dashboard.stablecoin.xyz)
2. Sign in (human step — agents cannot complete signup autonomously today)
3. Create an API key under **API keys**
4. Store the key as a secret; pass it as the `apiKey` path segment

Free-tier / testnet keys are available for development. No sales contact required for sandbox usage.

## Use the credential

```bash
curl -s -X POST \
  "https://api.aa.stablecoin.xyz/rpc/v1/baseSepolia/YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'
```

Use standard JSON-RPC 2.0 over POST. Bundler methods include `eth_sendUserOperation`, `eth_estimateUserOperationGas`, and paymaster sponsorship methods documented in OpenAPI.

## Errors

Invalid or missing keys return JSON-RPC errors, for example:

```json
{"jsonrpc":"2.0","id":null,"error":{"code":-32000,"message":"Invalid or missing API key"}}
```

## Revocation

Revoke or rotate keys in [dashboard.stablecoin.xyz](https://dashboard.stablecoin.xyz). Update your agent configuration with the new `apiKey` path segment.

## agent_auth note

SBC does not operate OAuth `register_uri` / `claim_uri` endpoints on this developer hub. Machine access to the paymaster RPC is API-key based. OAuth metadata for other SBC products may be published on dedicated API hosts when available.