AI sign-in

POST/v1/agent-sign-in-links

A one-time link that signs you in to the app as the person who made the key, in a browser profile nobody else is signed in to.

What it does

Works only when the CEO has switched on letting an AI sign in to the app. The link works once, within 60 seconds, and only when pasted into the address bar: a link followed from another site is refused. The session it opens is marked as an AI's, never reaches the company's security, billing, data, people, roles, audit log or AI budgets, never approves anything, and ends when the key ends. Six links an hour per person.

Who may call it

Any live key may call it. It reads only what the key's maker may already see about themselves.

Request

HTTP

POST https://panlytics.net/api/v1/agent-sign-in-links

Parameters

Name	In	Type	Required	What it is
`Authorization`	header	string	Yes	Bearer, a space, then the key.

Example request

curl -X POST https://panlytics.net/api/v1/agent-sign-in-links \
  -H "Authorization: Bearer $PANLYTICS_KEY"

import os

import requests

response = requests.post(
    "https://panlytics.net/api/v1/agent-sign-in-links",
    headers={"Authorization": f"Bearer {os.environ['PANLYTICS_KEY']}"},
    timeout=60,
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://panlytics.net/api/v1/agent-sign-in-links", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PANLYTICS_KEY}`,
  },
});
if (!response.ok) throw new Error(`Panlytics answered ${response.status}`);
console.log(await response.json());

Response

201: Created. The answer is what was made, as JSON.

Field	Type	Always there	What it is
`url`	string	Yes	The link. Open it once, within 60 seconds, by pasting it into the address bar of a browser profile nobody else is signed in to.
`expiresAt`	string (ISO 8601)	Yes	When the link stops working, in UTC: 60 seconds after it was made.

Example response

201

{
  "url": "https://panlytics.net/agent-sign-in#t=Q2xhdWRlLWV4YW1wbGUtdG9rZW4tbm90LXJlYWwtMDAw",
  "expiresAt": "2026-10-25T09:01:00.000Z"
}

Errors

A refusal is JSON with a code, a sentence in error, and a requestId when the fault is ours. Read the code, not the sentence. Every code is listed on Errors.

Status	Code	When	What to do
401	`api.key_missing`	The call had no Authorization header.	Send the key in the Authorization header as Bearer, then call again.
401	`api.key_refused`	The key is wrong, revoked, past its end, or its maker or company no longer allows it (developer mode off, the maker removed or switched off, or the maker's role lost the developer ability).	Ask the person who gave you the key to make a new one.
401	`api.wrong_key_kind`	This key does not open these endpoints.	Use the key these endpoints were made for, or ask the person who gave you the key.
403	`refused`	The key's maker may not do this here: their role lacks the ability, or the shop or category is outside their reach.	Ask the CEO for a role that allows it, or call it for a shop or category the role reaches.
403	`auth.not_fresh`	This step needs you to prove it is you.	Confirm your password or passkey, then try again.
403	`agent.sign_in_off`	Letting an AI sign in to the app is switched off for this company.	Ask your CEO to switch it on in the company's Developer settings.
429	`api.rate_limited`	The key made more than 120 calls in this minute. Wait the seconds in Retry-After.	Wait the seconds in Retry-After, then call again.
429	`agent.links_limit`	This key's maker has asked for six sign-in links in the last hour.	Wait a minute and ask for a new link.
500	`server`	Something failed on our side. The answer carries a requestId to quote.	Try again in a minute; if it keeps happening, report it.
503	`developer.unavailable`	API keys are not set up on this deployment yet.	Report it, and we will switch them on.