# MeetStream agent authentication

How an AI agent obtains and uses credentials for the MeetStream meeting bot API.

## Discover

- API contract: https://meetstream.ai/openapi.json (OpenAPI 3.1)
- Protected resource metadata: https://meetstream.ai/.well-known/oauth-protected-resource
- Agent resource catalog: https://meetstream.ai/.well-known/ai-catalog.json
- MCP server: https://mcp.meetstream.ai/mcp (Streamable HTTP)

An unauthenticated call to a protected endpoint returns `401` with a
`WWW-Authenticate` header naming the accepted scheme and the location of this
document.

## Pick a method

MeetStream accepts one credential type today: a long-lived **API key** presented
as a bearer-style token. There is no OAuth authorization server, so `agent_auth`
flows, `register_uri` dynamic client registration, `identity_assertion`
exchange, and `id-jag` tokens are **not** supported. An agent should not attempt
an authorization-code flow. Use the API key directly.

## Register

Account creation is self-serve at https://app.meetstream.ai. No sales call and
no waitlist. New accounts include $5 of free credit, which is enough to run a
first bot end to end without talking to anyone.

## Claim the credential

Sign in at https://app.meetstream.ai and generate an API key from the dashboard.
Keys are created and revoked by the account owner. A human must complete this
step; MeetStream does not issue credentials to an agent programmatically.

## Use the credential

Send the key on every request in the `Authorization` header using the `Token`
scheme.

```
curl -X POST https://api.meetstream.ai/api/v1/bots/create_bot \
  -H "Authorization: Token $MEETSTREAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"meeting_link": "https://meet.google.com/abc-defg-hij", "bot_name": "Notetaker"}'
```

The same header authenticates the MCP server at https://mcp.meetstream.ai/mcp.

## Errors

| Status | Meaning | What the agent should do |
|--------|---------|--------------------------|
| 401 | Missing or invalid key | Stop and ask the user for a valid key. Do not retry. |
| 403 | Key valid, action not permitted | Stop. The account lacks access to that resource. |
| 404 | Unknown bot or resource id | Verify the id before retrying. |
| 429 | Rate limited | Back off and retry after the interval in the response. |
| 5xx | Server error | Retry with exponential backoff. |

Never place the API key in a URL query string, a client-side bundle, or a
prompt that will be logged.

## Revocation

Revoke a key from the dashboard at https://app.meetstream.ai. Revocation takes
effect immediately and every in-flight request using that key begins returning
`401`. Rotate by creating the replacement key first, deploying it, then revoking
the old one.