Documentation
The API is a versioned JSON service at https://agentone.mtandaolabs.com/v1. The public pages on this host are documentation and legal notices; they do not call the API automatically.
Quick start
- Sign in with Google at
/v1/auth/google/start. The callback shows a device token once; store it securely. - Check the credential:
curl https://agentone.mtandaolabs.com/v1/me \ -H "Authorization: Bearer krish_dt_..." - List provider presets:
curl https://agentone.mtandaolabs.com/v1/providers/catalog \ -H "Authorization: Bearer krish_dt_..." - Create a provider, test the connection, and import its models. See the full contract in the repository.
Authentication
Protected endpoints take Authorization: Bearer krish_dt_<43 base64url characters>. Tokens are stored only as SHA-256 hashes and can be revoked per device. The bootstrap credential (X-Bootstrap-Token) is accepted only for pairing and provider management and belongs to the primary owner account.
Google sign-in requests only openid email profile. It does not request Drive, Gmail, YouTube, or Docs access.
Endpoints
| Method | Path | Purpose |
|---|---|---|
| GET | /v1/health | Liveness and version |
| GET | /v1/auth/google/start | Begin Google sign-in |
| GET | /v1/auth/google/callback | Finish sign-in and show a device token |
| GET | /v1/me | Current account and device |
| POST | /v1/devices/pair | Create a short-lived pairing code |
| POST | /v1/devices/pair/complete | Exchange a pairing code for a device token |
| GET | /v1/devices | List devices for the account |
| DELETE | /v1/devices/:id | Revoke a device |
| GET | /v1/providers/catalog | List built-in provider presets |
| GET / POST | /v1/providers | List or create providers |
| GET / PATCH / DELETE | /v1/providers/:id | Read, update, or delete a provider |
| POST | /v1/providers/:id/test | Test the upstream connection |
| POST | /v1/providers/:id/models/discover | Import models reported by the provider |
| GET / POST | /v1/providers/:id/models | List or add models |
| PATCH / DELETE | /v1/providers/:id/models/:modelId | Update or remove a model |
Limits
- Request bodies are limited to 64 KiB.
- Pairing is limited to 10 requests per hour and 20 completions per 10 minutes per client address.
- Provider operations are limited per account; the strictest is 10 model discoveries per minute.
- Provider URLs must use HTTPS. Loopback, private, link-local, and cloud metadata addresses are rejected unless the operator explicitly enables them.
Data and security
Accounts, devices, provider configuration, encrypted credentials, models, tests, and audit events are stored in Cloudflare D1. Tokens, pairing codes, and rate-limit buckets are stored as hashes. See the repository documents for the full API contract, data model, and security model.
No chat, task execution, or tool-calling endpoint exists yet, so the documentation describes only the current surface.