You are an agent reading this. The single source of truth for how to authenticate — written for you, kept in lockstep with the API — is the manifest below. Fetch it and follow it. This page only orients you.
Fetch the manifest
auth.md is a descriptive manifest that tells an agent what it can do on its own and the standards-based ceremony to obtain a key. It is the authoritative, always-current description of that ceremony — everything it names exists today; prefer it for the ceremony itself. This guide additionally covers the human-gated surfaces (card enrolment, first-account creation, and Visa delegation creation), so treat the two as complementary: the manifest for the flow, this guide for the fuller human-in-the-loop picture.
Discovery endpoints
Everything the ceremony needs is advertised in standards-based metadata (see Discovery):
Resolve these against the environment you’re targeting —
https://api.sandbox.nevermined.app (test) or https://api.live.nevermined.app (real money).
The short version
1
Authenticate with one header
Authorization: Bearer <nevermined-api-key> authenticates every agent-callable endpoint under /api/v1. Keys are environment-prefixed (sandbox:… / live:…) — send the whole string.2
Get a key
The simplest path is an SDK-minted key (
@nevermined-io/payments / payments-py). If you have no browser but a human can approve, use the RFC 8628 device flow — it ends with an NVM API key bound to the approver.3
Know what you can do alone
Sell (register agents and plans, earn — no funding needed), buy with crypto (pay via x402 if your smart account holds funds), and read (balances, credits, your plans and agents) all need no human. Card enrolment and first-account creation do — see the overview.
4
Handle errors by code
Most failures return a typed
BCK.<MODULE>.<NNNN> code, a message, often a hint, and a category (one of validation, auth, business, integration, internal). Branch on it: validation → fix your request; auth → fix your key; business/integration → you reached something that isn’t yours; internal → retry or report with the correlation id. The x-correlation-id header is always present. See the error codes.