---
title: smry authentication for agents
description: Anonymous public reading plus scoped OAuth or personal-key authentication for account tools.
canonical: https://smry.ai/auth.md
last-updated: 2026-08-29
---

# smry authentication for agents

## Discover

The public reader at https://r.smry.ai is anonymous and needs no registration,
claim, login, cookie, API key, or delegated user permission. The Developer API
and MCP server operate on user-owned data and accept scoped Clerk OAuth or a
personal smry key from any signed-in account, Free included.

## Pick a method

Use anonymous public reading for source retrieval. When the user asks to access
private account data, prefer OAuth for an interactive agent and use a personal
`smry_` key for a local or unattended client that can protect it.

## Register

Fetch https://api.smry.ai/.well-known/oauth-protected-resource (or the path-specific
`/mcp` metadata), then follow the advertised authorization-server metadata.
Interactive clients may dynamically register at the advertised endpoint and
must use Authorization Code with PKCE. Request `smry:read` for read-only REST
operations or `smry:write` for mutations and MCP. A local client may instead
ask the user to create a revocable personal key at
https://smry.ai/mcp-api-cli?view=keys.

## Claim

There is no claim or identity-assertion step for the anonymous reader. OAuth
consent delegates only approved scopes and can be revoked by the user. A
personal key represents the smry account that created it; possession is not
permission to share it, expose it in logs, or persist it insecurely.

## Use the credential

Send an OAuth access token or personal key only to https://api.smry.ai as
`Authorization: Bearer <credential>`. Store personal keys in `SMRY_API_KEY`
or another protected credential store; OAuth clients must use PKCE and protect
refresh tokens. Never put a credential in a URL, browser bundle, repository,
prompt, or source document.

## Errors

A 401 includes an OAuth discovery challenge and means the credential is absent,
invalid, expired, or revoked. A 403 with `insufficient_scope` requires explicit
user consent for the advertised scope; another 403 can indicate an ineligible
plan or owner boundary and must not be worked around. A 429 includes
`Retry-After`; wait before retrying instead of looping.

## Revocation

Revoke OAuth grants from the user's connected-app settings and personal keys at
https://smry.ai/mcp-api-cli?view=keys. Anonymous reader access has no
credential to revoke. Canonical installation and MCP setup instructions are at
https://smry.ai/agent-setup/prompt.md.