Authentication

AICP uses Bearer tokens for all requests. There are two kinds of token:

Token type	Format	Use case
API key	aicp-…	Server-to-server, long-lived, created in the dashboard
Session JWT	Standard JWT	Returned after auth.login() / auth.signup(), expires in 24 h

Pass either as a Bearer token:

Authorization: Bearer aicp-...

Signing up

const result = await client.auth.signup({
  orgName:  'Acme Corp',
  email:    'you@acme.com',
  password: 'super-secret',
  userName: 'Your Name',   // optional
});

// result.token is a session JWT, set it on the client
client.setApiKey(result.token);

Logging in

const result = await client.auth.login({
  email:    'you@acme.com',
  password: 'super-secret',
});

client.setApiKey(result.token);

Accepting an invitation

When a team member invites you, they send a link containing a token. Use it to set your password and get a session:

// First, inspect the invite
const info = await client.auth.getInviteInfo(token);
console.log(info.email, info.orgName);

// Then accept and get a session
const result = await client.auth.acceptInvite({
  token,
  name:     'New Member',
  password: 'my-password',
});

client.setApiKey(result.token);

Using a permanent API key

For server-side applications, create an API key in the dashboard (Settings → API Keys) and pass it directly:

const client = new AICPClient({
  apiKey:  'aicp-...',
  baseUrl: 'https://your-gateway',
});

API keys do not expire unless you delete them.