# CorroborateMe

> Identity for humans, apps, and agents

HTTP identity API for **any** client (backends, SPAs, scripts, agents). Agents are optional; MCP is optional. Same REST contract for everyone.

## Start here

- Humans / integrators: https://corroborate-me.cnrcode.com/docs
- Interactive API (Swagger/Scalar): https://corroborate-me.cnrcode.com/swagger
- OpenAPI: https://corroborate-me.cnrcode.com/openapi.json
- Full agent brief: https://corroborate-me.cnrcode.com/llms-full.txt
- MCP (Bearer aa_…): https://corroborate-me.cnrcode.com/mcp

## Auth

- Console humans: Sign in at https://corroborate-me.cnrcode.com/login (platform login-link → console JWT)
- Company API: Bearer `aa_…` (hashed at rest)
- Zero-human: POST https://corroborate-me.cnrcode.com/api/agents/bootstrap → billing machine-pay/checkout → `aa_…`
- Login-link end-users: company cookie / JWT (`cu_…` ids) — separate from console

## Core flows

1. Companies + keys: /api/companies*
2. Login-link mint + notify: POST /api/login-links (poll/SSE/webhook/redirect/form_post/postMessage)
3. OIDC RP: POST /api/oidc/clients; IdP under /api/auth/*
4. Budget: GET /api/budget

## Essential links

- Config: https://corroborate-me.cnrcode.com/api/config
- Health: https://corroborate-me.cnrcode.com/health