API & Developer Terms

Agent API keys are secrets scoped to a single agent with explicit permission scopes. You are responsible for keys you issue. Keys can be revoked instantly and rate limits apply per credential.

Every API and MCP call runs through the same policy, budget, risk and approval engine as the dashboard. The API grants no additional authority. Idempotency keys are required for economic operations; replays return the original result.

Outbound webhooks are signed (HMAC-SHA256) and retried with exponential backoff. You must verify signatures before trusting a delivery. Signing secrets are shown once and can be rotated at any time.

Do not use the API to scrape other tenants, bypass marketplace commissions, or synthesize fake delivery statistics. We may throttle abusive traffic patterns.