Agent Registration

Agent registration is in beta.

AI agents and MCP clients like Claude, Cursor, and OpenClaw can register themselves with your Migma account. Start with the first path that works:

Hosted MCP: add https://migma.ai/mcp and approve in the browser.
CLI: run migma login.
Direct client without a working OAuth callback: fetch https://api.migma.ai/auth.md and approve the claim code (this page).
CI: set MIGMA_API_KEY. Do not send agents to Settings to copy a key.

Clients with a working browser callback can send you through Migma’s OAuth consent page. Direct agents without that callback can show you a short claim code. In both cases, the agent receives its own scoped API key without you copying or pasting a secret.

Why use it

No key handling

The agent receives its own key directly. The secret never passes through chat, clipboards, or config files you manage by hand.

You approve every agent

Before any access is granted you see the agent’s name and exactly which permissions it asked for, then approve it in Migma.

Scoped access

The key carries only the permissions the agent requested, such as read-only access or sending. Nothing more.

Revoke anytime

Agent keys appear in Settings → Developers → API Keys next to your own keys. Delete one and the agent loses access immediately.

This works with OAuth-capable MCP clients and with direct agents that can make HTTPS requests, poll, keep claim tokens private, and securely store a returned credential. Reading a web page alone is not enough. Migma follows the auth.md convention so capable agents can discover the flow.

How it works

OAuth connector approval

Your client asks to connect

Add Migma as a connector or hosted MCP server. The client discovers Migma’s sign-in and consent flow automatically.

You review and approve

Migma opens migma.ai/connect/authorize. You see the app name, return host, and requested permissions before approving. Sending access is highlighted as email:send.

The client receives its key

Once you approve, Migma gives the client a scoped API key automatically. You do not copy or paste a key.

Claim-code fallback

Your agent asks to connect

While working on your behalf, the agent registers with Migma and shows you a short code together with a link to migma.ai/claim. The agent does not approve its own request.

You review and approve

Open the link, sign in (or create a free account), and enter the code. Migma shows the agent’s name and the permissions it requested before you confirm.

The agent picks up its key

Once you approve, the agent automatically receives a scoped API key and continues working. The key is shown to the agent exactly once.

For agents

Everything an agent needs is published at:

https://api.migma.ai/auth.md

Machine-readable metadata is at https://api.migma.ai/.well-known/oauth-authorization-server. OAuth-capable clients should use the authorization-code flow with PKCE. Direct agents that cannot complete the OAuth redirect/callback can use claim-code when they can securely store the returned credential. Claim-code does not repair a broken hosted connector. login_hint is optional — identity binds to whoever signs in and approves in the browser. In short:

# 1. Register intent for the user you act for
curl -X POST https://api.migma.ai/agent/identity \
  -H "Content-Type: application/json" \
  -d '{"type":"service_auth","agent_name":"Claude"}'

# 2. Surface claim.user_code and claim.verification_uri_complete to the user

# 3. Poll until approved
curl -X POST https://api.migma.ai/oauth2/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type":"urn:workos:agent-auth:grant-type:claim","claim_token":"<from step 1>"}'

The returned access_token is a standard Migma API key. Use it everywhere a key works: the REST API, the SDK, the CLI, and MCP, typically by setting MIGMA_API_KEY. For the full protocol — discovery endpoints, scopes, code lifecycle, poll-loop error codes, and a complete poll-loop example — see the agent-auth developer reference.

Security

Claim-code approval requires a signed-in Migma user entering a short-lived code. The email an agent mentions is display only and grants nothing by itself.
OAuth consent requires a signed-in Migma user approving the client at migma.ai/connect/authorize.
Requested scopes are capped to the standard API permissions and shown to you before approval.
email:send allows test and direct email. campaign:write allows campaign creation, send, and schedule. A credential with campaign:write is not no-send.
Codes expire after ten minutes and a registration expires after one hour.
The key is delivered to the agent exactly once and is never shown again.
Keep claim tokens and the returned key out of chat, logs, shell history, and shared remote-computer files.
Revoke any agent key in Settings → Developers → API Keys.
IT and security reviewers: MCP for IT admins.

Getting Started

Tools

MCP Clients

AI App Builders

Agent Access

Agent Registration

Why use it

No key handling

You approve every agent

Scoped access

Revoke anytime

How it works

OAuth connector approval

Claim-code fallback

For agents

Security

​Why use it

No key handling

You approve every agent

Scoped access

Revoke anytime

​How it works

​OAuth connector approval

​Claim-code fallback

​For agents

​Security

Why use it

How it works

OAuth connector approval

Claim-code fallback

For agents

Security