# Zoo API: signing in

Every call takes one header: `Authorization: Bearer <credential>`. The credential is an API key (`sk-live-…`) or an access token from Zoo's identity server, https://zoolabs.id. That server runs every sign-in and mints every token; this API validates them and holds no password.

The whole recipe, every body included: https://zoo.ngo/llms.txt

## A terminal or a device with no browser

OAuth device authorization (RFC 8628): `POST https://zoolabs.id/v1/iam/oauth/device` answers a code and a page; a person opens the page and enters the code while the device polls `POST https://zoolabs.id/v1/iam/oauth/token` with `grant_type=urn:ietf:params:oauth:grant-type:device_code`.

## A person

Create and revoke API keys at https://console.zoo.cloud/api-keys.

## An app

OpenID Connect against https://zoolabs.id: the authorization code flow with PKCE (`S256`). Metadata: https://zoolabs.id/.well-known/openid-configuration.

## Scopes

`openid`, `profile`, `email`, `offline_access`. What a token may do is decided by its own user and organizations.

## Discovery

- Protected resource metadata (RFC 9728): https://api.zoo.ngo/.well-known/oauth-protected-resource
- Authorization server metadata (RFC 8414): https://zoolabs.id/.well-known/oauth-authorization-server
- MCP: `POST https://api.zoo.ngo/v1/mcp` answers a tool call that carries no credential with 401 and a `WWW-Authenticate` header naming the resource metadata.