# Get an API key through your agent

To get an API key through your AI agent, ask it to call start_signup with what data you want and why. It shows you an approval link and an eight-character code; you open the link, sign in or create a free account, and approve. The agent then calls finish_signup with its device code and receives the key once.

Anyone connecting an agent for the first time. The flow is built like a device login on a TV: the agent never sees a password and never creates an account by itself, and you approve exactly one key for exactly that agent.

## The prompt

```
Get me a samgovapi.io API key. I want SAM.gov registration and opportunity data to check teaming partners and find bids in NAICS 541512.
```

## What the agent calls

1. start_signup: Opens a pending signup and returns approval_url, user_code and device_code.

```json
{"name":"start_signup","arguments":{"data_wanted":"SAM.gov registrations and contract opportunities in NAICS 541512","use_case":"vet teaming partners and find bids","agent":"Claude Code"}}
```

2. finish_signup: Polled every 5 seconds until you approve; returns the key exactly once.

```json
{"name":"finish_signup","arguments":{"device_code":"sgd_..."}}
```

## Sample output

Trimmed; field names and structure match the live response, values are shortened or illustrative.

```json
{
  "user_code": "K7QM-4TXZ",
  "approval_url": "https://samgovapi.io/connect?code=K7QM-4TXZ",
  "device_code": "sgd_...",
  "expires_in": 900,
  "interval": 5,
  "poll_url": "https://samgovapi.io/api/v1/agent/token"
}
```

## How to read the answer

- expires_in is 900 seconds: approve within 15 minutes or the agent starts again.
- The key arrives once. Ask the agent to store it as the SAMGOVAPI_API_KEY environment variable or in your client's secret store, not in a chat message you will share.
- After the key, data tools need the account's onboarding questions answered once: the agent calls get_onboarding_questions and answer_onboarding with what you told it.

## Make it yours

- Without MCP, the same flow is POST /api/v1/agent/signup then POST /api/v1/agent/token with the device code.
- If you already have an account, approving simply adds a new key to it.

## Pitfalls

- Never paste your password into a chat. The approval page is the only place you sign in.
- If the approval page says the code expired, ask the agent to start over; old device codes cannot be revived.

## The same job over REST

```bash
curl "https://samgovapi.io/api/v1/agent/signup" -H "Authorization: Bearer $SAMGOVAPI_API_KEY"
```

Plan: every plan. Credits: 0: signup and onboarding tools cost no credits.

## Questions

### Does the agent create an account for me?

No. You create or sign in to your account in the browser and approve the key yourself.

### Can I revoke the key later?

Yes, from the API keys page of your dashboard.

All recipes: https://samgovapi.io/agents/recipes.md

Independent. Not affiliated with, endorsed by or sponsored by GSA, SAM.gov or any U.S. government agency. Registering in SAM.gov is free at sam.gov.