# Authentication for Agents — SEO Bandwagon

How AI agents and developers authenticate with SEO Bandwagon's APIs.

## What's protected

- MCP server: https://seobandwagon.com/api/mcp — all tools require authentication.
- Public (no auth): /api/v1/captures, /api/health, and all
  /.well-known/ discovery endpoints.

## Scheme

HTTP Bearer token: an opaque SEO Bandwagon API key (format: sbw_ followed by 48 hex characters). Keys are issued per user — request one at https://seobandwagon.com/contact. Send it as: Authorization: Bearer sbw_<key>.

There is **no OAuth authorization server** for this API. Tokens are opaque
API keys, not OAuth access tokens — do not attempt an OAuth flow. Resource
metadata (RFC 9728, without authorization servers) is published at
https://seobandwagon.com/.well-known/oauth-protected-resource.

## Registration

Registration is manual (no self-serve or dynamic client registration yet):

1. Create an SEO Bandwagon account at https://seobandwagon.com/auth/signin.
2. Request an API key via https://seobandwagon.com/contact (keys are shown once at
   creation; only a hash is stored).
3. Send it on every request: `Authorization: Bearer sbw_<key>`.
   Unauthenticated requests receive 401.

Keys are scoped to your account (`gsc:read`, `rank:read`). To revoke a
key, use the same contact channel.

## More

- API documentation: https://seobandwagon.com/docs/api
- API catalog: https://seobandwagon.com/.well-known/api-catalog
- MCP server card: https://seobandwagon.com/.well-known/mcp/server-card.json