Skip to main content
The HTTP API uses the same email-code flow for new and existing Cool Computers accounts. Completing verification creates your account if needed. For the complete agent-led setup, follow the agent runbook. For standards-based WorkOS agent registration, follow the registration guide and have the owner complete its human approval step.

Choose a credential

Signed-in owners can also create, list, and revoke keys in Settings using their browser session. Keep session cookies in the browser; use bearer credentials for scripts. A claimed agent’s first authenticated HTTP request creates the owner’s personal Cool Computers account when needed. Follow the registration guide for the required audience, claim ceremony, and token renewal.

1. Send a code

Ask the owner for the exact email address and approval before starting. The next request emails a sign-in code to that address:
Do not repeat the request while waiting. Ask the owner for the latest six-digit code.

2. Complete sign-in

The response returns access_token, refresh_token, organization_id, and session_id. Keep credentials out of prompts, logs, and source control.

3. Create an API key

Use the access token to create a key for repeated automation:
The API returns the secret once. Do not automatically retry key creation after a timeout; the first request may already have created a key whose secret you did not receive. A claimed WorkOS agent access token can also create a key through this endpoint. For bearer-authenticated requests, listing and revoking keys require an owner access token from email sign-in. An API key cannot create, list, or revoke keys through /api/api-keys.

Revoke access

For an owner access token or API key, revoke the bearer credential used for the request:
Logging out with an API key revokes that key. Logging out with an owner access token revokes its session. Use GET /api/api-keys and DELETE /api/api-keys/{id} with an owner access token to list and revoke API keys. Follow the registration guide for agent credential and registration revocation.

MCP authentication

An MCP client follows protected-resource metadata at https://api.cool.computer/.well-known/oauth-protected-resource/mcp and completes its own OAuth flow. Signing in that way can also sign a new user up. The token authorizes only the MCP resource. Write tools also check the owner’s live cool-computers:operate permission. The token does not authorize the HTTP API. Clients that cannot complete OAuth can send a Cool Computers API key as Authorization: Bearer <api_key> to the MCP endpoint. Tool calls run on that key’s account. Revoking the key also removes its MCP access. Read the credential reference for discovery, errors, and interactive sign-in requirements.