# How it works

https://superintelligentkey.com/how-it-works/

How an app and an agent sign a person in with Key, and where the docs are.

## How an app signs in

- Key is a standard OpenID Connect provider at auth.superintelligentkey.com, with discovery, JWKS and PKCE.

- A person signs in with a six-digit code sent to their email. Key keeps no passwords.

- Your app gets a short-lived access token and an ID token, and checks them against Key's published keys.

## How an agent signs in

- An agent names itself with a client metadata document, then sends the person to Key to sign in.

- The person sees which agent is asking and what it may do, and chooses Allow or Don't allow.

- With that consent the agent uses Key's MCP server at mcp.superintelligentkey.com, and every change it asks for is previewed before it happens.

## Docs and contact

### For developers

The API is described by its OpenAPI document, /v1/openapi.json on api.superintelligentkey.com, and the MCP server publishes its protected-resource metadata. Send a real User-Agent header with every request.

### Security

Report a security issue to the contact in the security.txt file under /.well-known/ on any Key host.