# Certiv authentication

Machine-readable authentication guide for AI agents, assistants, and automated
clients evaluating or integrating with Certiv.

For general Certiv context see https://certiv.ai/llms.txt and
https://certiv.ai/AGENTS.md. For the public forms API schema see
https://certiv.ai/openapi.json. Full product API documentation lives at
https://docs.certiv.ai.

## API surfaces

Certiv exposes two distinct HTTP surfaces with different authentication:

1. Public lead-capture API (no authentication).
2. Product API (account required, bearer-token authentication).

### 1. Public lead-capture API - no authentication

Base URL: `https://forms.certiv.ai`

Endpoints:

- `POST /demo-request` - request a product demo.
- `POST /newsletter` - subscribe to the product newsletter.

These endpoints are public and require no credentials. They accept and return
`application/json`. This is the only Certiv surface that an unauthenticated
agent can call. It is described by the OpenAPI 3.1 spec at
https://certiv.ai/openapi.json.

### 2. Product API - account required

Base URL: `https://api.certiv.ai`

The Certiv product API (agent discovery, runtime context, continuous
authorization, policy, and reporting) is private. It requires a Certiv
organization account and is not open for anonymous or self-serve agent access.
Access is provisioned per organization.

## Authentication method

The product API uses bearer-token authentication over HTTPS. Present the token
in the standard `Authorization` header on every request:

```
Authorization: Bearer <token>
```

A token is either an organization-scoped API key or a session token issued to a
signed-in user. Both are carried the same way, in the `Authorization: Bearer`
header. All requests must be made over TLS; tokens must never be sent as query
parameters or over plaintext HTTP.

## Obtaining credentials

1. Sign in to the Certiv product console at https://app.certiv.ai with an
   account that belongs to a Certiv organization.
2. Generate or retrieve an API key for your organization from the console.
3. Treat the key as a secret. Rotate it if it is exposed.

If your organization does not yet have Certiv access, request it via
https://certiv.ai/demo/ or the public lead-capture API above. Autonomous agents
cannot self-provision product credentials; a human with an organization account
completes onboarding.

For the current step-by-step issuance and rotation flow, see the authentication
guide at https://docs.certiv.ai.

## Scopes and permissions

Access is scoped to the caller's organization. A token only grants access to the
organization it was issued for, and to the resources and actions permitted for
that account. Tenant isolation is enforced server-side: a token for one
organization cannot read or act on another organization's data.

## Example authenticated request

```
curl https://api.certiv.ai/... \
  -H "Authorization: Bearer $CERTIV_API_KEY" \
  -H "Accept: application/json"
```

Replace the path with the endpoint you need from https://docs.certiv.ai. A
missing or invalid token returns an HTTP 401.

## SDK and CLI

A Python SDK and CLI are published on PyPI as `certiv`:

```
pip install certiv
```

The SDK reads the API key from your environment and sets the
`Authorization: Bearer` header for you. See https://docs.certiv.ai for usage.

## Related discovery endpoints

- https://certiv.ai/llms.txt - machine-readable site and resource index.
- https://certiv.ai/AGENTS.md - agent briefing on what Certiv is and when to use it.
- https://certiv.ai/openapi.json - OpenAPI spec for the public forms API.
- https://certiv.ai/.well-known/security.txt - security contact.
- https://docs.certiv.ai - full product API and authentication documentation.