canonical: https://jentic.com/apis/corroborateme.com/corroborateme

# CorroborateMe API

The CorroborateMe API proves end users to agents and apps through login-links, API keys, and OIDC. It mints one-time login-link sessions that bridge an interactive human login, supports OTP, password, and passkey flows on those sessions, and registers OIDC relying-party clients with discovery and JWKS endpoints. Companies manage their own API keys, console members, OIDC clients, and login-link end-users, including GDPR erase, and can read remaining quotas before issuing more verifications.

## For AI agents

Create one-time login-link sessions to verify a human, mint and revoke company API keys, and register OIDC clients. Authenticated with a bearer token that may be a console JWT, end-user JWT, bootstrap JWT, or API key; several endpoints are public.

## Scope

Does not handle payment processing, email delivery, or analytics. Use for verifying end users through login-links, API keys, and OIDC only.

## Capabilities

- Create a one-time login-link session and poll its status until the human completes it
- Verify a human through OTP, password, or passkey flows on a login-link
- Mint and revoke a company's API keys
- Register and revoke OIDC relying-party clients for single sign-on
- List login-link end-users and GDPR-erase a specific user
- Read remaining verification quotas for a company
- Bootstrap a humanless company onboarding to issue an agent its own key

## Use cases

### Human Verification for Agents

An agent that needs a real person to confirm an action creates a one-time login-link session and polls it until the human signs in through OTP, password, or passkey. CorroborateMe bridges the interactive login and returns the completed session, so the agent gets a verified end user without implementing the login UI itself.

Example prompt: Create a session with POST `/api/login-links`, then poll GET `/api/login-links/{id}` until the login completes

### Programmatic Key and OIDC Management

A company agent mints scoped API keys, revokes keys that are no longer needed, and registers OIDC relying-party clients for single sign-on. CorroborateMe returns key metadata without ever re-exposing secrets and exposes OIDC discovery and JWKS, so the agent can wire SSO and rotate credentials under one company.

Example prompt: Mint a key with POST `/api/companies/{id}/keys`, then register an SSO client with POST `/api/oidc/clients`

### AI Agent Integration via Jentic

An AI agent reaches CorroborateMe through Jentic without handling the bearer token itself. It searches by intent, receives the matching operation and its input schema, and executes the call with the credential injected at run time. This lets an agent request a human verification mid-task without the builder wiring login-link polling by hand.

Example prompt: Search Jentic for 'create a login-link for a user', load the POST `/api/login-links` schema, and execute it with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/api/login-links` | Create a one-time human login-link session |
| GET | `/api/login-links/{id}` | Poll a login-link status |
| POST | `/api/companies/{id}/keys` | Mint a company API key |
| POST | `/api/companies/{id}/keys/{keyId}/revoke` | Revoke a company API key |
| POST | `/api/oidc/clients` | Register an OIDC relying-party client |
| GET | `/api/end-users` | List login-link end-users |
| GET | `/api/budget` | Read remaining quotas for a company |

## Key resources

- **Login-links** — Create and poll one-time human login sessions via `/api/login-links`
- **API keys** — Mint, list metadata for, and revoke company keys via `/api/companies/{id}/keys`
- **OIDC clients** — Register, list, and revoke OIDC relying-party clients via `/api/oidc/clients`
- **End-users** — List and GDPR-erase login-link end-users via `/api/end-users`

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 45 / 100
- **Maturity:** Foundational
- **Dimensions:**
  - Foundational Compliance: 93 / 100
  - Developer Experience & Jentic Compatibility: 58 / 100
  - AI-Readiness & Agent Experience: 21 / 100
  - Agent Usability: 93 / 100
  - Security: 60 / 100
  - AI Discoverability: 64 / 100
- **View full report:** https://jentic.com/apis/corroborateme.com/corroborateme/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring CorroborateMe by hand means managing a bearer token that can take several forms, polling login-link sessions while a human completes OTP or passkey steps, and tracking which endpoints are public. Through Jentic you install once, import CorroborateMe from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** CorroborateMe puts the company id in the URL path (`/api/companies/{id}/...`), so a rule can pin your agent to one company: it can create login-links and read key metadata for that company and nothing else. You choose which operations it may call, so destructive ones like key revocation or GDPR end-user erase are not included unless you add them.
- **Credential handling:** Your CorroborateMe credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a login-link' or 'mint an API key', and Jentic returns the matching CorroborateMe operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0** — Hosted identity platform for login, MFA, and token issuance
- **Stytch** — Passwordless authentication with OTP, magic links, and passkeys
- **Okta** — Enterprise identity, SSO, and directory services

## FAQ

### What authentication does the CorroborateMe API use?

The CorroborateMe API authenticates with a bearer token in the Authorization header, per its OpenAPI spec. That token can be a console session JWT, a company end-user JWT, a bootstrap JWT, or a company API key. Health, public config, and the interactive login-link steps are open and need no credential. Through Jentic the key is stored encrypted by your own Jentic One instance and injected at execution time, so it never reaches the agent.

### Can I verify a human with the CorroborateMe API?

Yes. You create a one-time login-link session, then poll its status while the person completes an OTP, password, or passkey login, and read the completed session when they finish. The login-link bridges the interactive login so an agent gets a verified end user without building the login UI.

### What are the rate limits for the CorroborateMe API?

The OpenAPI spec does not publish specific rate-limit numbers; check https://corroborateme.com/swagger for current details. The budget endpoint reports a company's remaining verification quotas, so an agent can confirm it has headroom before minting keys or issuing login-links.

### Is there a CorroborateMe MCP server?

You don't need an MCP server to give your agent CorroborateMe. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent calls the login-link and key operations. Nothing extra is loaded into the agent's context until an operation is actually invoked.

### Can I limit what my agent is allowed to do with the CorroborateMe API?

Yes. CorroborateMe puts the company id in the URL path, so write a rule that pins your agent to one company and allows only the login-link and key-read operations, leaving key revocation and GDPR erase out of reach. Every call runs through your own Jentic One instance and is logged for you to review.

### How do I create a login-link with the CorroborateMe API through Jentic?

Search Jentic for 'create a login-link for a user', and it returns the CorroborateMe login-link operation with its input schema. Load the schema and execute POST `/api/login-links`, then poll GET `/api/login-links/{id}`, with the credential injected at run time. To run it on your own infrastructure, install Jentic One from its GitHub repo.