You are an agent reading this. The single source of truth for how to authenticate — written for you, kept in lockstep with the API — is the manifest below. Fetch it and follow it. This page only orients you.
Fetch the manifest
auth.md is the authoritative, always-current description of the authentication ceremony: the discovery metadata, the bearer contract, how to get a key (SDK, the RFC 8628 device flow, or — when you run inside an AI assistant such as Claude, ChatGPT or LangSmith Fleet — the OAuth commerce consent your host obtains for you against the Commerce MCP), what you can do without a human, and how to read errors. Everything it names exists today — follow it for the ceremony itself.
For the human-in-the-loop picture and how each path maps to a credential, the Authentication & Identity overview covers the human-gated surfaces (card enrolment, first-account creation, Visa delegation creation) and the resource→credential mapping. Treat the two as complementary: the manifest for the flow, the overview for the human decisions around it.
When you hand a human an authorization_endpoint or a device-flow verification_uri, keep its ?network=sandbox|live query string intact — the overview explains the per-tier discovery quirk. Drop it and consent is served on whichever tier the browser last used (Live by default), so a Sandbox-only connector is then refused.
Two more things the discovery document tells you. It advertises authorization_response_iss_parameter_supported: true: every redirect the consent screen sends back to your redirect_uri — success and denial — carries iss, equal to the document’s issuer; compare the two and reject a mismatch before you redeem a code (RFC 9207). And it advertises no scopes_supported — Nevermined enforces no scope vocabulary at the API layer — with one exception the consent screen honours: if you took the authorize URL from discovery and want the commerce consent (an account-level spend cap for paying external services through the Router, with no agent_id), send scope=commerce; it selects that consent exactly as a hand-configured consent_type=commerce would (details).
If you are an MCP host that presents an https URL as its client_id (ChatGPT, Claude Code), you need no registration at all for agent-specific grants; a commerce grant additionally needs the operator to have listed your URL — ChatGPT, Claude (the claude.ai connector) and Claude Code are listed out of the box (details).