# Auth.md

## Agent registration

Surp supports anonymous agent access through either per-request x402 payment signatures or prepaid Bearer API keys.

### Registration

Agents can register or obtain a prepaid API key at https://surp.ivc.lol/app. API key credentials are sent as `Authorization: Bearer <key>` and must not be exposed in public metadata.

### Supported credentials

- `x402_payment_signature`: per-request EIP-3009 USDC authorization on Base.
- `bearer_api_key`: prepaid API key for server-to-server inference.

### Protected resource metadata

See https://surp.ivc.lol/.well-known/oauth-protected-resource.

### Claims and revocation

Account claims: https://surp.ivc.lol/api/user/me
API-key revocation: https://surp.ivc.lol/api/user/api-keys

Surp never receives or stores private wallet keys.