# auth.md

Audience: AI agents integrating Pangram detection APIs.

## Authentication

Pangram APIs authenticate with long-lived **API keys** sent in the `x-api-key` HTTP header. Bearer OAuth tokens are not used for API calls today. OAuth discovery documents under `/.well-known/` describe registration and claim flows; credentials are still claimed as API keys from the dashboard.

## Registration

1. Sign up at https://www.pangram.com/signup
2. Open the API key page at https://www.pangram.com/apikey
3. Create an API key and send it as `x-api-key` on each request

## API endpoints

- Text detection: `https://text.external-api.pangram.com`
- Image detection: `https://image.external-api.pangram.com`

## Further reading

- API docs: https://docs.pangram.com/quickstart
- Protected resource metadata: https://www.pangram.com/.well-known/oauth-protected-resource
- API catalog (RFC 9727): https://www.pangram.com/.well-known/api-catalog
- OpenAPI (text API): https://www.pangram.com/.well-known/openapi/text-api.json
- AI catalog: https://www.pangram.com/.well-known/ai-catalog.json