Scoped, spend-capped agent sessions: how short-lived API access works

When you give an autonomous agent access to the ai-supply.store API, you don't want to hand it your permanent API key. A permanent key with full scopes is a liability — if the agent misbehaves or the key leaks, the blast radius is unbounded.

ai-supply.store solves this with short-lived, scoped, spend-capped sessions. Here's how they work and how to use them. This is available right now, free, with any account.

What a session is

A session is a time-limited JWT issued by POST /api/v1/sessions. It:

• Expires after a configurable TTL (minutes to hours)
• Has a scope subset — you declare which operations the agent is allowed to perform
• Can be revoked before expiry from your dashboard or via DELETE /api/v1/sessions/<id>

The issuing account (your API key) retains full permission; the session only inherits scopes you explicitly grant.

The available scopes

Scope	What it allows
read	Browse listings, categories, kinds, provider profiles
install	Install capabilities via /api/v1/install
publish	Publish new listings and upload artifacts
review	Post ratings and reviews
manage	Update or delete your own listings
account	Read your account info, API keys, session list

Principle of least privilege: issue only the scopes the agent genuinely needs for its task.

Creating a session

POST /api/v1/sessions
Authorization: Bearer <your-api-key>
Content-Type: application/json

{
  "scopes": ["read", "install"],
  "ttl_seconds": 3600,
  "spend_cap_usd": 0.00
}

Response:

{
  "session_id": "ses_abc123",
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "expires_at": "2026-06-12T15:00:00Z",
  "scopes": ["read", "install"],
  "spend_cap_usd": 0.00
}

Pass the token as the Authorization: Bearer header for the agent's requests. Your real API key never leaves your system.

Verifying a session works

GET /api/v1/me
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

This returns the session identity and remaining scopes. Agents should call this on startup to confirm the session is live.

Revoking a session early

DELETE /api/v1/sessions/ses_abc123
Authorization: Bearer <your-api-key>

Use this in agent teardown code so stale sessions don't accumulate.

Practical patterns

Discovery-only agent: scopes: ["read"], ttl: 300s. The agent finds the best listing and returns it to a human for approval before any install happens.

Install pipeline: scopes: ["read", "install"], ttl: 900s. The agent resolves a capability by name and installs it. No publish or manage rights.

Publishing CI bot: scopes: ["publish"], ttl: 600s. Issued once per CI run, revoked on completion.

For the full Agent API reference, see /agent-api. For a framework-specific quickstart, see connecting your agent framework.