> ## Documentation Index
> Fetch the complete documentation index at: https://docs.securelend.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with SecureLend AI Agents — human OAuth flow and M2M machine registration for AI agents and pipelines.

# Authentication

SecureLend AI Agents uses OAuth 2.0. There are two authentication paths depending on whether a human is involved.

## Human / Interactive (Authorization Code)

For human users connecting via ChatGPT, Claude Desktop, or any browser-based MCP client.

Most MCP clients handle this automatically. When you add the endpoint, the client opens a browser window, you sign in with your SecureLend account, and the client stores the token.

**Discovery document:**

```
GET https://agents.securelend.ai/.well-known/oauth-authorization-server
```

**Endpoints:**

```
Authorization:  https://agents.securelend.ai/oauth/authorize
Token:          https://agents.securelend.ai/oauth/token
Registration:   https://agents.securelend.ai/oauth/register
```

**Scopes:** `openid email profile`

**Sign up:** [agents.securelend.ai](https://agents.securelend.ai) or via the ChatGPT App Store.

Human accounts receive the full monthly free tier:

* 15 pitch deck prechecks
* 3 IC memos
* 10 document pages
* 5 extractions
* and more

***

## M2M (Machine-to-Machine)

For AI agents, automated pipelines, and applications that need to call SecureLend tools programmatically without a browser.

### Step 1 — Register

One API call creates a dedicated Cognito App Client and seeds a free trial quota:

```bash theme={null}
curl -s -X POST "https://agents.dev.securelend.ai/oauth/m2m/register" \
  -H "Content-Type: application/json" \
  -d '{"client_name": "My Agent"}'
```

**Response:**

```json theme={null}
{
  "client_id": "abc123...",
  "client_secret": "xyz...",
  "client_name": "My Agent",
  "grant_types": ["client_credentials"],
  "token_endpoint": "https://agents.dev.securelend.ai/oauth/token",
  "mcp_endpoint": "https://agents.dev.securelend.ai/mcp",
  "scope": "https://agents.dev.securelend.ai/mcp.access",
  "token_request_example": "curl -s -X POST https://agents.dev.securelend.ai/oauth/token -u \"CLIENT_ID:CLIENT_SECRET\" -d \"grant_type=client_credentials&scope=https://agents.dev.securelend.ai/mcp.access\"",
  "free_quota": {
    "pitch_deck_precheck": 1,
    "credit_memo_drafting": 1,
    "document_classification": 2,
    "financial_data_extraction": 1
  },
  "pricing": {
    "pitch_deck_precheck": "$0.50/check",
    "credit_memo_drafting": "$4.99/memo (1 free to validate full workflow)",
    "entity_compliance": "$0.60/check",
    "document_intelligence": "$0.06/page"
  },
  "note": "M2M trial: 1 free precheck + 1 free IC memo. Human signup for full monthly free tier."
}
```

Store `client_id` and `client_secret` securely. These are permanent credentials for your agent.

### Step 2 — Get a Token

```bash theme={null}
curl -s -X POST "https://agents.dev.securelend.ai/oauth/token" \
  -u "CLIENT_ID:CLIENT_SECRET" \
  -d "grant_type=client_credentials&scope=https://agents.dev.securelend.ai/mcp.access"
```

**Response:**

```json theme={null}
{
  "access_token": "eyJ...",
  "expires_in": 3600,
  "token_type": "Bearer"
}
```

Tokens are valid for **1 hour**. Cache and reuse — request a new token when it expires.

### Step 3 — Call Tools

```bash theme={null}
curl -s -X POST "https://agents.dev.securelend.ai/mcp" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {
      "name": "list_rubric_templates",
      "arguments": {}
    },
    "id": 1
  }'
```

### Rate Limits

M2M registration is limited to **3 registrations per IP address per 24 hours** to prevent abuse. For enterprise volume or additional clients, contact [support@securelend.ai](mailto:support@securelend.ai).

### M2M Free Tier vs Human Free Tier

M2M free trial is sized for discovery — enough to validate the full workflow end-to-end before committing to payment:

| Tool                          | M2M trial | Human monthly |
| ----------------------------- | --------- | ------------- |
| `pitch_deck_precheck`         | 1         | 15            |
| `professional_memo_agent`     | 1         | 3             |
| `document_intelligence_agent` | 2 pages   | 10 pages      |
| `data_extraction_agent`       | 1 page    | 5 pages       |
| `automated_underwriting`      | 1         | 3             |

After the free tier, tools charge per call via Delegare (card or USDC on Base).

***

## Setting Up Payments (After Free Tier)

When your free quota is exhausted, tool calls return a 402 with instructions. Use the `initiate_payment_setup` tool to authorize a spending budget:

```
# From within any MCP session (human or M2M):
initiate_payment_setup(maxMonthlyBudgetUsd: 50, rail: "both")

→ Returns a URL. Open it in a browser.
→ Enter a card OR sign one crypto wallet transaction (~30 seconds).
→ All future tool calls charge automatically. No further prompts.
```

Or check setup status after authorizing:

```
check_payment_setup(session_token: "sess_xxx")
→ { status: "complete", mandate: "active" }
```

**Payment rails:**

* **Fiat (Stripe)** — enter card details once, charged per call
* **USDC on Base** — sign one EIP-3009 permit transaction from a crypto wallet, then fully autonomous

[Payment setup guide →](/agents/payments)

***

## Token Validation

SecureLend AI Agents validates tokens against the Cognito user pool:

```
Token signing keys: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_1YH9dLyZN/.well-known/jwks.json
Issuer: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_1YH9dLyZN
```

Both human JWT access tokens and M2M client credentials tokens are validated against this JWKS endpoint.