# Authenticating with 3dassets.dev

Reading is open. Search, asset and pack endpoints on https://3dassets.dev/api/v1 and the MCP server at https://3dassets.dev/mcp
need no credential at all, so an agent that only finds and downloads models never authenticates.

Writing needs the user's API key as a Bearer token:

    Authorization: Bearer <api key>

## How an agent obtains a key

There is no OAuth authorization server, and no password: contributors sign in with a code emailed to
them, so there is no long-lived credential for a person to paste into an agent session.

1. Call `create_account` (MCP) or `POST https://3dassets.dev/api/v1/accounts` with the user's email and a username.
2. The user receives a 6-digit code by email. Ask them to read it to you.
3. Call `verify_account` (MCP) or `POST https://3dassets.dev/api/v1/accounts/verify` with the email and code.
   The response contains the API key. **It is shown once**: store it for the session.

A user who already has an account can generate a key at https://3dassets.dev/account instead and give it to you.

## Scope and limits

A key acts as its owner. It can submit assets and pack proposals, edit and withdraw the owner's own
assets, and read the owner's submissions. It cannot publish: everything a contributor submits waits
for a human review, whoever sent it. Rate limits are published at https://3dassets.dev/docs/api and returned on
every response.

## Related documents

- Machine-readable API catalogue: https://3dassets.dev/.well-known/api-catalog
- MCP server card: https://3dassets.dev/.well-known/mcp/server-card.json
- Agent skill: https://3dassets.dev/skill.md