Authentication — MediaKit Agent Commerce

API keys

Create an agent and its keys under Panel → Developers. Keys start with mk_live_, are shown once, can expire and be revoked; only a hash is stored.

Metadata: https://mediakit.uk/.well-known/oauth-authorization-server and https://mediakit.uk/.well-known/oauth-protected-resource
Register: POST https://mediakit.uk/oauth/register {client_name, redirect_uris} → public client_id (no secret)
Authorize: https://mediakit.uk/oauth/authorize?response_type=code&client_id=…&redirect_uri=…&code_challenge=…&code_challenge_method=S256&state=…
Token: POST https://mediakit.uk/oauth/token grant_type=authorization_code with code_verifier; refresh_token rotates on use
Revoke: POST https://mediakit.uk/oauth/revoke
Access tokens live 1 hour, refresh tokens 30 days. Consent grants at most "order with approval"; autonomous buying is set by the owner in the panel.

discovery: catalog:read
quote (default): + quotes:write, content:validate, orders:read, webhooks:write
approval: + orders:write, content:write, payments:write — every order needs the owner
autonomous: orders within limits without asking (payment by invoice link or balance)
prepaid: autonomous, paid from the prepaid balance