# TalkChief auth.md

This document explains how AI agents and server-side integrations authenticate to TalkChief APIs. The public marketing website at `https://talkchief.io` does not require authentication.

## Current authentication model

TalkChief currently uses customer-specific API keys for its protected integration APIs. API keys are provisioned manually for an approved TalkChief customer and managed by an organization administrator in the TalkChief dashboard under **Settings > Integration**.

There is no public, machine-callable agent registration or credential-provisioning endpoint. A workspace request at `https://talkchief.io/en/register` and a demo request at `https://talkchief.io/en/schedule-a-demo` are human-managed onboarding requests; they do not immediately create an API credential.

## Supported credential methods

| Capability | Credential use |
| --- | --- |
| Click-to-Call API | Send the per-company Click-to-Call key in the JSON request field `api_key`. |
| AI Transcription API | Send the per-company AI key in the `X-AI-Api-Key` request header. |
| CDR webhook | Configure the destination and delivery settings in the customer dashboard. Refer to the dashboard documentation for the current payload and delivery contract. |

The approved API base URL, complete request contract, and downloadable OpenAPI 3.0 document are provided to customers in the dashboard. Examples on the public developer page are illustrative and are not authorization to call an API.

## Agent registration status

- OAuth 2.0 authorization-server discovery is not currently supported.
- OpenID Connect (OIDC) discovery is not currently supported.
- OAuth dynamic client registration and autonomous agent registration are not currently supported.
- Identity assertions, anonymous agent credentials, and verified-email credential claims are not currently accepted registration methods.
- TalkChief does not publish a token endpoint, JWKS URI, or public OAuth client-registration endpoint.

Do not infer OAuth or bearer-token support from this file. An agent that needs protected API access must operate for an existing TalkChief customer and obtain an authorized API key through that customer's administrator and the TalkChief team.

## Credential handling

- Keep API keys on a trusted server. Never embed them in browser code, mobile applications, public prompts, logs, or source repositories.
- Send credentials only to the approved HTTPS API base URL shown in the authenticated dashboard.
- Use the API-specific key for the intended integration and rotate it from **Settings > Integration** when staff or systems change.
- Never send TalkChief API keys to `talkchief.io` marketing forms or to a third-party agent service.

## Public references and support

- Developer platform: `https://talkchief.io/en/developers`
- Machine-readable API catalog: `https://talkchief.io/.well-known/api-catalog`
- Agent-readable site guide: `https://talkchief.io/llms.txt`
- Support: `support@talkchief.io`

Last verified against the public TalkChief website repository: 2026-08-01.