| Audience or route | Accepted credential | Notes |
|---|---|---|
| Console and session-only management | Clerk session | Human identity required |
General /v1/applications/** management |
Clerk session or amqp_ personal access token |
Role checks still apply |
/v1/agent/** |
Exactly one Bearer amq_ Agent key or admitted private Bot execution credential |
Application-scoped machine identity |
/v1/account/** |
Clerk session only | A token cannot mint or revoke another token |
| Invitation preview and acceptance | Clerk session only | Binds the invited human identity |
| Device approval | Clerk session only | Start and poll remain unauthenticated |
/v1/topups/stripe/** |
Clerk session only | Owner authorization and payment consent |
| Consumer commands | Consumer OIDC flow and command-specific state/session | Per-user application boundary |
| OAuth callback | Single-use OAuth state | No AgentMQ session required |
/v1/platform/** |
Clerk session for an allowlisted workspace operator | Not an application-member API |
/v1/internal/** |
Configured private service credential | Never expose to public clients |
| Webhooks | Provider-specific signature over the raw request | Browser redirects are not payment proof |
Session-only path set
/v1/account/**/v1/invitations/preview/v1/invitations/accept/v1/device/approvals/v1/topups/stripe/**
Public reads and bootstrap calls
GET /v1/config, GET /v1/purchases/catalog, device start/poll/token collection, the OAuth callback, and signed callbacks have explicit narrow authentication rules. Their availability does not grant application access by itself.