Skip to main content
Agent registration is in beta.
AI agents and MCP clients like Claude, Cursor, and OpenClaw can register themselves with your Migma account. Browser-capable clients can send you through Migma’s OAuth consent page. Non-browser agents can show you a short code. In both cases, the agent receives its own scoped API key without you copying or pasting a secret.

​
Why use it

No key handling

The agent receives its own key directly. The secret never passes through chat, clipboards, or config files you manage by hand.

You approve every agent

Before any access is granted you see the agent’s name and exactly which permissions it asked for, then approve it in Migma.

Scoped access

The key carries only the permissions the agent requested, such as read-only access or sending. Nothing more.

Revoke anytime

Agent keys appear in Settings → Developers → API Keys next to your own keys. Delete one and the agent loses access immediately.
This works with OAuth-capable MCP clients and with any agent that can read a web page. Migma follows the auth.md convention, so agents discover and complete the right flow on their own.

​
How it works

​
OAuth connector approval

1

Your client asks to connect

Add Migma as a connector or hosted MCP server. The client discovers Migma’s sign-in and consent flow automatically.
2

You review and approve

Migma opens migma.ai/connect/authorize. You see the app name, return host, and requested permissions before approving. Sending access is highlighted as email:send.
3

The client receives its key

Once you approve, Migma gives the client a scoped API key automatically. You do not copy or paste a key.

​
Claim-code fallback

1

Your agent asks to connect

While working on your behalf, the agent registers with Migma and shows you a short code together with a link to migma.ai/claim.
2

You review and approve

Open the link, sign in (or create a free account), and enter the code. Migma shows the agent’s name and the permissions it requested before you confirm.
3

The agent picks up its key

Once you approve, the agent automatically receives a scoped API key and continues working. The key is shown to the agent exactly once.

​
For agents

Everything an agent needs is published at:
Machine-readable metadata is at https://api.migma.ai/.well-known/oauth-authorization-server. OAuth-capable clients should use the authorization-code flow with PKCE. Agents that cannot open the OAuth consent page can use the claim-code fallback. For that path, login_hint is required and must be the email of the user the agent acts for. In short:
The returned access_token is a standard Migma API key. Use it everywhere a key works: the REST API, the SDK, the CLI, and MCP, typically by setting MIGMA_API_KEY. For the full protocol — discovery endpoints, scopes, code lifecycle, poll-loop error codes, and a complete poll-loop example — see the agent-auth developer reference.

​
Security

  • Claim-code approval requires a signed-in Migma user entering a short-lived code. The email an agent mentions is display only and grants nothing by itself.
  • OAuth consent requires a signed-in Migma user approving the client at migma.ai/connect/authorize.
  • Requested scopes are capped to the standard API permissions and shown to you before approval.
  • Sending access is shown as email:send.
  • Codes expire after ten minutes and a registration expires after one hour.
  • The key is delivered to the agent exactly once and is never shown again.
  • Revoke any agent key in Settings → Developers → API Keys.