# Quota Queue auth.md

Quota Queue supports authorized agents through workspace-scoped API keys.

## Agent registration

This is a human-delegated registration flow for agents acting on behalf of a Quota Queue workspace administrator. Unattended public registration and anonymous credential issuance are not supported.

- Registration URI: https://quotaqueue.com/sign-up
- Existing-user sign-in: https://quotaqueue.com/sign-in
- Supported identity type: authenticated workspace administrator
- Issued credential type: workspace API key

## Provisioning

1. The authorizing person signs in at https://quotaqueue.com/sign-in or registers a workspace at https://quotaqueue.com/sign-up.
2. A workspace administrator opens **Settings → API keys**.
3. The administrator creates a key with the minimum required permission: read, write, or admin.
4. The secret is shown once and must be stored in the agent client's secret or environment configuration.

## Credential use

Send the API key as an HTTP Bearer credential:

```http
Authorization: Bearer qq_live_REDACTED
```

API keys are accepted by https://quotaqueue.com/api/v1 and https://quotaqueue.com/mcp. They must not be placed in URLs, prompts, source files, or logs.

## Discovery

- API documentation: https://quotaqueue.com/docs/api
- OpenAPI description: https://quotaqueue.com/api/v1/openapi.json
- MCP server card: https://quotaqueue.com/.well-known/mcp/server-card.json

## OAuth status

The Quota Queue REST API currently uses workspace API keys and does not accept OAuth access tokens. It therefore does not advertise OAuth authorization-server, OpenID Connect, or OAuth protected-resource metadata. Human application sign-in is provided separately and must not be treated as authorization for the REST API.