---
title: "Authentication matrix"
description: "Credential requirements for every AgentMQ API audience."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication matrix

| Audience or route | Accepted credential | Notes |
| --- | --- | --- |
| Console and session-only management | Clerk session | Human identity required |
| General `/v1/applications/**` management | Clerk session or `amqp_` personal access token | Role checks still apply |
| `/v1/agent/**` | Exactly one Bearer `amq_` Agent key or admitted private Bot execution credential | Application-scoped machine identity |
| `/v1/account/**` | Clerk session only | A token cannot mint or revoke another token |
| Invitation preview and acceptance | Clerk session only | Binds the invited human identity |
| Device approval | Clerk session only | Start and poll remain unauthenticated |
| `/v1/topups/stripe/**` | Clerk session only | Owner authorization and payment consent |
| Consumer commands | Consumer OIDC flow and command-specific state/session | Per-user application boundary |
| OAuth callback | Single-use OAuth state | No AgentMQ session required |
| `/v1/platform/**` | Clerk session for an allowlisted workspace operator | Not an application-member API |
| `/v1/internal/**` | Configured private service credential | Never expose to public clients |
| Webhooks | Provider-specific signature over the raw request | Browser redirects are not payment proof |

## Session-only path set

- `/v1/account/**`
- `/v1/invitations/preview`
- `/v1/invitations/accept`
- `/v1/device/approvals`
- `/v1/topups/stripe/**`

## Public reads and bootstrap calls

`GET /v1/config`, `GET /v1/purchases/catalog`, device start/poll/token collection, the OAuth callback, and signed callbacks have explicit narrow authentication rules. Their availability does not grant application access by itself.

Source: https://help.agent.mq/reference/authentication/index.mdx