---
title: "Coverage Cat OAuth and Agent Auth"
description: "Coverage Cat auth docs covering service-owned agent identity claims, OAuth token exchange, OTP compatibility flows, and where delegated umbrella and homeowners flows require authenticated operator credentials."
canonical: "https://www.coveragecat.com/developers/auth"
last-updated: "2026-10-02"
---

# Coverage Cat OAuth and Agent Auth

## Coverage Cat auth model

Coverage Cat exposes both public and authenticated surfaces:

- Public: `/api/agent`, `/api/agent/openapi.yaml`, `/openapi.json`, `/ai/skills`, the runtime markdown skills, and the developer portal.
- Authenticated: delegated umbrella purchase endpoints and delegated homeowners quote endpoints.

## Machine-readable auth discovery

Coverage Cat also publishes a machine-readable auth surface for agents:

- `/auth.md`
- `/developers/get-api-key`
- `/.well-known/oauth-protected-resource`
- `/.well-known/oauth-authorization-server`
- `/agent/identity`, `/agent/identity/claim`, `/oauth2/token`, and `/oauth2/revoke`
- `/agent/auth`, `/agent/auth/claim`, and `/agent/auth/revoke` for compatibility

The primary path is a user-claimed OAuth flow that returns a short-lived `id-jag` identity assertion and then exchanges it for an `access_token`. The compatibility path still supports direct OTP claims for either a short-lived `access_token` or a longer-lived `api_key`.

## OTP setup flow

Use the operator or integrator email, never the end-customer email.
If you are reading this in a browser and want the human-readable walkthrough first, open `/developers/get-api-key`.

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/request   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com"}'
```

Then confirm the code and receive the key:

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/confirm   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com","otp":"123456"}'
```

Rotate with the existing bearer key:

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/rotate   -H "Authorization: Bearer ccop_..."
```

## Where Coverage Cat requires bearer auth

- `POST /api/agent/umbrella/draft`
- `POST /api/agent/umbrella/quotes`
- `POST /api/agent/umbrella/select`
- `POST /api/agent/umbrella/bind`
- `POST /api/agent/umbrella/status`
- `POST /api/agent/umbrella/attach`
- `POST /api/agent/homeowners/quotes`
- `GET /api/agent/homeowners/dashboard`
- `POST /api/agent/homeowners/dashboard/session`
- `POST /api/agent/homeowners/fix-issues-email`

## Coverage Cat auth guardrails

- Store the issued key in a server-side secret manager.
- Do not embed the key in browser code or customer-visible prompts.
- Do not use shared environment keys where Coverage Cat explicitly requires operator-issued keys.
- Read the homeowners operator setup guide before you issue a live key: `/ai/skills/homeowners/setup`.