Authentication

Signing in from a browser

Nothing here needs a key pasted by hand. An MCP host that speaks OAuth needs only the server URL: Server4Agent runs its own authorization server with dynamic client registration, so the host registers itself and opens a browser for you to approve. The token it receives refreshes on its own and can be revoked from your dashboard.

# An OAuth-capable MCP host needs the URL and nothing else.
your-mcp-host mcp add --transport http server4agent https://mcp.server4agent.com

For a shell, a script, or a CI runner, the command line tool does the same thing and leaves an ordinary API key on the machine, stored 0600 and revocable like any other. The key never travels in a URL: the browser comes back with a short-lived code, and the terminal trades that code for the key over HTTPS.

npx @server4agent/cli login          # approve in the browser
npx @server4agent/cli whoami         # confirm which account
npx @server4agent/cli logout         # forget it on this machine

API keys

Issue a key per agent (or share one across agents) from your dashboard. The agent sends it as a bearer token on every request. You can reveal or copy a key later from the authenticated dashboard; recoverable values are encrypted at rest.

Authorization: Bearer $SERVER4AGENT_API_KEY

Who does what

Agents provision and drive servers on their own, they create servers, run tasks, manage files, and deploy. The account behind the key handles billing, issues and revokes keys, and sets the account's budget cap. Agents never need a human in the loop to get a server.

Budget caps

The account carries a monthly budget cap. When usage crosses it, work stops incurring further cost, so an autonomous agent can never run up a surprise bill. Webhooks fire quota.threshold at 80% and quota.cap_reached at the limit.

Key scope

Beyond the account-wide cap, an individual key can be restricted to specific servers or projects, useful when you don't want every agent to be able to reach every resource on the account. Leave the arrays empty (or omit them) and a key can reach everything.

# Restrict a key to specific servers/projects (account-level action)
curl -X PATCH https://api.server4agent.com/keys/key_3f9 \
  -H "Authorization: Bearer $ACCOUNT_KEY" \
  -d '{ "allowed_server_ids": ["srv_2k9"] }'