Authentication

Overview

AgentPowers uses Clerk for authentication. All authenticated API requests require a Bearer token in the Authorization header.

API Authentication

Include a Bearer token in the Authorization header:

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.agentpowers.ai/v1/purchases

CLI Authentication

The CLI handles authentication automatically:

ap login

This opens your browser for OAuth sign-in via Clerk. After authenticating, the CLI stores a long-lived token locally with restricted file permissions.

ap whoami    # Check current session
ap logout    # Clear stored token

CLI Token Lifecycle

Step	What happens
`ap login`	Browser OAuth via Clerk, long-lived token stored locally
API calls	CLI sends token automatically on every request
`ap logout`	Token revoked server-side, local credentials deleted
Token expiry	After 90 days, re-run `ap login` to get a new token
New login	Creating a new token automatically revokes the previous one

Plugin Authentication

The MCP plugin shares the same auth token stored by the CLI. Log in once with the CLI and the plugin picks it up automatically.

Public vs Authenticated Endpoints

Endpoint	Auth Required
`GET /v1/skills`	No
`GET /v1/skills/{slug}`	No
`GET /v1/search`	No
`GET /v1/categories`	No
`GET /v1/detail/{slug}`	No
`GET /v1/skills/{slug}/download` (free)	No
`GET /v1/skills/{slug}/download` (paid)	Yes
`POST /v1/skills`	Yes
`POST /v1/checkout`	Yes
`GET /v1/purchases`	Yes
`GET /v1/purchases/confirm`	Yes
`POST /v1/installations`	Optional (anonymous external installs are silently ignored)
`POST /v1/skills/{slug}/reviews`	Yes
`GET /v1/skills/{slug}/reviews`	No
`GET /v1/users/profile`	Yes
`PATCH /v1/users/profile`	Yes
`GET /v1/sellers/status`	Yes
`POST /v1/sellers/connect`	Yes
`GET /v1/sellers/earnings`	Yes
`GET /v1/sellers/skills`	Yes
`GET /v1/sellers/sales`	Yes
`GET /v1/sellers/revenue`	Yes
`GET /v1/sellers/revenue/breakdown`	Yes
`GET /v1/sellers/activity`	Yes
`GET /v1/sellers/{slug}`	No
`GET /v1/sellers/{slug}/skills`	No

Rate Limits

Tier	Limit
Public reads	60 requests/minute
Authenticated reads	10 requests/minute
Write operations	20 requests/minute

Rate limits are per IP address for all requests. Exceeding the limit returns 429 Too Many Requests.

Need Help?

Email Support

Reach us at support@agentpowers.ai for account issues, billing questions, or technical help.

Discord Community

Join the AgentPowers Discord to get help from the team and other creators in real time.

Getting Started

Guides

Reference

Overview

API Authentication

CLI Authentication

CLI Token Lifecycle

Plugin Authentication

Public vs Authenticated Endpoints

Rate Limits

Need Help?

Email Support

Discord Community

​Overview

​API Authentication

​CLI Authentication

​CLI Token Lifecycle

​Plugin Authentication

​Public vs Authenticated Endpoints

​Rate Limits

​Need Help?

Email Support

Discord Community

Overview

API Authentication

CLI Authentication

CLI Token Lifecycle

Plugin Authentication

Public vs Authenticated Endpoints

Rate Limits

Need Help?