# Agent API Authentication Schemes and Bearer Tokens
Status: public
Confidence: medium (0.865) (verified)
Last verified: 2026-06-02
Generation: ai_structured


## TL;DR

Authentication scheme metadata tells agents how to call an API without leaking, misplacing, or over-scoping credentials.

## Core Explanation

Agents should identify the authentication scheme before making requests. API keys, bearer tokens, Basic Auth, OAuth tokens, and signed requests have different placement, expiry, and security rules. A token that is safe on a server may be unsafe in browser-executed code.

Useful evidence includes the required header, token format, scope, audience, expiry, allowed origins, and whether the API's OpenAPI document exposes a security scheme. Agents should avoid guessing from one successful request because providers may use multiple schemes across endpoints.

## Source-Mapped Facts

- Stripe API documentation describes authentication with API keys and HTTP Basic Auth. ([source](https://docs.stripe.com/api/authentication))
- Google Cloud documentation describes authentication as determining the identity of a client. ([source](https://docs.cloud.google.com/docs/authentication))
- The OpenAPI Specification defines a Security Scheme Object for authentication and authorization schemes. ([source](https://spec.openapis.org/oas/v3.1.0#security-scheme-object))

## Further Reading

- [Stripe API Authentication](https://docs.stripe.com/api/authentication)
- [Google Cloud Authentication](https://docs.cloud.google.com/docs/authentication)
- [OpenAPI Security Scheme Object](https://spec.openapis.org/oas/v3.1.0#security-scheme-object)