# V7 auth.md This page describes how AI agents and API clients should discover and use V7 authentication resources. Canonical developer resources: /developers. API overview: /api. Official docs: https://docs.v7labs.com. ## Discover Start with /developers, /api, /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server, and https://docs.v7labs.com. Agents should inspect /openapi.json and /api/openapi.yaml for security schemes when a production OpenAPI schema is available. ## agent_auth skill: https://v7labs.com/auth.md register_uri: https://v7labs.com/contact identity_types_supported: anonymous, identity_assertion anonymous.credential_types_supported: api_key identity_assertion.assertion_types_supported: id-jag identity_assertion.credential_types_supported: oauth2, api_key ## Pick a method Prefer the authentication method documented for the specific V7 workspace and API operation. If OAuth metadata is published, follow the authorization server metadata. If an API key is issued, treat it as a scoped bearer credential. ## Register Use the official V7 account, workspace, docs, or contact flow to request API access. If self-serve registration is available in the V7 app, agents should guide the user there rather than requesting secrets in chat. ## Claim Credentials should be issued for a specific workspace, environment, and scope. Agents should record whether the credential is for production, sandbox, or test mode. ## Use the credential Send bearer credentials only over HTTPS. Do not expose secrets in prompts, logs, URLs, screenshots, or public pages. Before destructive operations, confirm user intent and prefer /sandbox or /test-mode.md guidance. ## Errors If authentication fails, agents should expect a structured JSON error when available. A 401 may include WWW-Authenticate: Bearer resource_metadata=”https://v7labs.com/.well-known/oauth-protected-resource”. See /errors and /errors.md. ## Revocation Revoke credentials through the official V7 account, admin, or support process. Rotate credentials if they were exposed or used by an untrusted agent. Related resources: /agent-auth.md, /auth, /api, /sandbox, /errors, /developers/llms.txt.