# Auth.md — Interest Rates API agent registration

Interest Rates API supports two equivalent ways for an agent to
authenticate. Both resolve to the same account and the same
underlying credential (your API key) — OAuth is offered as an
alternate, standards-based front door for agents that already speak
OAuth.

## 1. Create an account

Register at https://rates-api.zylalabs.com/register (email + password; a verification
email is sent and must be confirmed before an account can create API
keys).

## 2. Subscribe to a plan

Every plan (Starter, Pro, Business) includes a 7-day free trial; a
payment method is required to start it. Subscribe at
https://rates-api.zylalabs.com/billing. Plan quotas, rate limits, and pricing are
documented at https://rates-api.zylalabs.com/docs.

## 3. Generate an API key

Create a key from https://rates-api.zylalabs.com/api-keys. Keep it secret — never
expose it in client-side JavaScript or public repositories.

## 4a. Call the API with the key directly (simplest)

Send the key as a query parameter on every request:

```
GET https://rates-api.zylalabs.com/api/v1/latest?symbols=FED_FUNDS,SOFR&api_key=YOUR_API_KEY
```

The backend only reads the `api_key` query parameter for this
method — not an `Authorization` or `X-API-Key` header. (The separate
MCP server at https://mcp.interestratesapi.com does accept a header
or `?apikey=` and translates it to this query parameter on your
behalf.)

## 4b. OAuth 2.0 client_credentials

- Discovery: `GET /.well-known/oauth-authorization-server`
- Protected resource metadata: `GET /.well-known/oauth-protected-resource`
- Token endpoint: `POST /oauth/token`
  (`grant_type=client_credentials`, `client_id`, `client_secret`)
- `client_id` is shown next to each key at https://rates-api.zylalabs.com/api-keys;
  `client_secret` is the key itself.
- Returns a bearer token (1 hour TTL). Send it as
  `Authorization: Bearer <token>` instead of `?api_key=`.

## Registration

- register_uri: https://rates-api.zylalabs.com/register
- identity assertion: verified_email (email verification required
  before an account can create API keys)
- credential types supported: api_key, oauth2_client_credentials
- claim / manage credentials: https://rates-api.zylalabs.com/api-keys
- revoke a credential: revoke the key at https://rates-api.zylalabs.com/api-keys
  (this also invalidates any bearer tokens issued from it)

## Rate limits & plans

See https://rates-api.zylalabs.com/docs for plan tiers, quotas, and the 7-day free
trial. Each plan enforces a monthly request quota and a per-minute
rate limit independently; quota resets on the 1st of each month.