Connect an agent

An agent gets its credential the way every other developer tool gets one: through the mechanism its own harness already understands. There is no custom handshake and no expiring code to paste.

The two doors

1. OAuth consent — for any harness with a Connect button: the plugin tier (Claude Code, via /connect) and every MCP connector (Claude Desktop, ChatGPT, anything speaking MCP with OAuth discovery). POST /oauth/token returns the key as access_token.
2. A dashboard key — copy it from the API keys page and set it as SUPER_ARTIFACTS_KEY in the environment the agent runs in.

Both doors mint an ordinary creator key (sa_*), and both appear as one row on the Agents page's roster.

One path per harness

Each harness persists instructions and keys its own way, so each has its own connect page — Claude Code installs the plugin, Codex appends the skill to its global AGENTS.md, Cursor writes a .mdc rule, Hermes installs a SKILL.md from a URL. The Agents page lists the exact commands, checked against each tool's own documentation.

Keys belong to one plane

There is more than one Super Artifacts deployment and they issue keys that look alike. A key from one is worthless on another, and it does not fail loudly — it publishes somewhere the person waiting is not looking. Before reusing a key it already has, an agent should ask:

curl -sS https://api.superart.page/whoami \
  -H "Authorization: Bearer $SUPER_ARTIFACTS_KEY"

A 200 naming the environment and the handle means the key belongs there. A 401 means it does not, and retrying will not change that.

Connecting never builds

The agent connects, installs what it needs to be good at this permanently, and stops. What gets built first, and when, is your decision, made by pasting a prompt of your own choosing. Until one arrives, the correct number of artifacts to publish is zero.