You are an agent reading this. The single source of truth for how to authenticate — written for you, kept in lockstep with the API — is the manifest below. Fetch it and follow it. This page only orients you.
Fetch the manifest
auth.md is the authoritative, always-current description of the authentication ceremony: the discovery metadata, the bearer contract, how to get a key (SDK or RFC 8628 device flow), what you can do without a human, and how to read errors. Everything it names exists today — follow it for the ceremony itself.
For the human-in-the-loop picture and how each path maps to a credential, the Authentication & Identity overview covers the human-gated surfaces (card enrolment, first-account creation, Visa delegation creation) and the resource→credential mapping. Treat the two as complementary: the manifest for the flow, the overview for the human decisions around it.
When you hand a human an authorization_endpoint or a device-flow verification_uri, keep its ?network=sandbox|live query string intact — the overview explains the per-tier discovery quirk. Drop it and consent is served on whichever tier the browser last used (Live by default), so a Sandbox-only connector is then refused.