---
title: "EvalGate authentication for people and agents"
description: "Truthful browser, API-key, MCP, and OAuth discovery boundaries."
canonical: "https://www.evalgate.com/docs/authentication"
last-updated: 2026-08-24
---

# EvalGate authentication for people and agents

## Browser account creation

Production signup uses interactive GitHub or Google sign-in at
[https://www.evalgate.com/auth/sign-up](https://www.evalgate.com/auth/sign-up).
EvalGate does not ask for an email/password pair, send a separate EvalGate
verification email, or require a card for the free allowance.

## API and CLI authentication

Authenticated REST, SDK, CLI, and proprietary tool operations use an EvalGate
API key in `Authorization: Bearer <key>`. An authorized organization member
creates and revokes keys under Developer → API Keys. The secret is shown once.

## MCP authentication

The MCP Streamable HTTP endpoint is `POST https://www.evalgate.com/api/mcp`.
It accepts scoped EvalGate bearer keys. Protected Resource Metadata is exposed
at `/.well-known/oauth-protected-resource/api/mcp` only when a real external
authorization server is configured; otherwise it fails closed.

## Unsupported flows

EvalGate does not currently operate a third-party OAuth authorization server,
publish RFC 8414 authorization-server metadata, support non-interactive account
registration, or issue credentials to an unauthenticated agent. Do not infer
authorization, token, registration, claim, or revocation endpoints that are not
listed in [OpenAPI](https://www.evalgate.com/openapi.json).

## Public access

Credential-free operations are explicitly marked unauthenticated in OpenAPI.
The public custom-eval demo is rate-limited and is not a production-like
sandbox.