---
title: "Authentication for agents"
description: "How AI agents and applications authenticate with the FNLB API."
canonical: "https://developers.fnlb.net/auth"
markdown: "/auth.md"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://developers.fnlb.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication for agents

FNLB supports three credentials for the HTTP API and gateway. Pick one based on who the caller acts as.

## Credential types

| Kind | Prefix | Acts as | How to get it |
| :--- | :--- | :--- | :--- |
| User session / account token | varies | Signed-in user | Browser login on the developer portal |
| API token | `FNLB_` / `FNLBAT_` | Your account | [app.fnlb.net/account](https://app.fnlb.net/account) |
| OAuth2 access token | `FNLBOA2AT_` | A user who approved your app | [OAuth2 guide](/docs/oauth2.md) |

Send the token on every request:

```http
Authorization: Bearer FNLBAT_YOUR_TOKEN
```

Details: [Authenticating](/docs/authenticating.md).

## OAuth2 for third-party apps

1. Create an application in the [developer portal](/docs/developer-portal.md).
2. Send the user to the authorize URL (`https://fnlb.net/oauth2/authorize`) with `response_type=code`, `client_id`, `redirect_uri`, `scope`, and `state`. Public clients must use S256 PKCE.
3. Exchange the code at `POST https://api.fnlb.net/v1/oauth2/token`.
4. Call the API with `Authorization: Bearer FNLBOA2AT_...`.

Full flow: [OAuth2](/docs/oauth2.md).

### Discovery metadata

Agents should load:

- [OpenID configuration](https://auth.fnlb.net/.well-known/openid-configuration) — OIDC issuer `https://auth.fnlb.net`
- [OAuth authorization server](/.well-known/oauth-authorization-server) — API OAuth2 endpoints used by applications
- [OAuth protected resource](/.well-known/oauth-protected-resource) — `https://api.fnlb.net` and `https://gateway.fnlb.net`

### Scopes

`identify`, `email`, `connections`, `bots.read`, `bots.write`, `bots.run`, `categories.read`, `categories.write`, `commands.run`, `openid`, `profile`.

Request only what the app needs. Unverified applications can only be approved by their owner.

## Registration

Create clients in the portal UI ([Applications](/)). There is no public dynamic client registration endpoint. Confidential clients receive a secret (`FNLBOA2S_`); public clients use PKCE only.

## Agent indexing

- Prefer Markdown: `Accept: text/markdown` or append `.md` to any docs URL.
- Start at [/llms.txt](/llms.txt).
- Full guide corpus: [/llms-full.txt](/llms-full.txt).