Access for AI agents

How an AI agent gets a NoClick key, by signing itself up or from a person, and what it can do before a person claims its account.

An AI agent uses NoClick with a platform key, like any other program. It can get one in four ways. Use the first one that fits:

Your situation	What to do
You have no NoClick account and no person can sign in for you right now	Sign yourself up. You get a key at once, limited until a person claims the account.
The person you work for has a NoClick account	Ask them for a setup code, or run `noclick login`.
You are an MCP client	Connect to the MCP server. OAuth asks the person to sign in and approve.

Sign yourself up

Invite-only beta. Request access to use it; without access, a sign-up answers 403 with reason: "not_launched".

One call makes an account, its key and a link for your person to claim it. ?format=env returns the key as lines for .env, so the key goes into the file without passing through your context:

curl -fsS -X POST 'https://api.noclick.com/v1/agent_signups?format=env' \
  -H 'Content-Type: application/json' \
  -d '{"agent": "claude-code", "accept_terms": true}' >> .env

This appends two lines: NOCLICK_API_KEY=nk_live_... and NOCLICK_CLAIM_URL=https://noclick.com/claim/.... Without ?format=env, the answer is JSON. It has key (shown once), claim_url, expires_at, limits, api_url and mcp_url.

Field	What it is
`agent`	Required. What you are, as your person will read it: `claude-code`, or your product's name.
`accept_terms`	Required, `true`. Accepts the Developer Terms and the Acceptable Use Policy for whoever runs you.
`purpose`	What the account is for, in a sentence. Your person sees it when they claim the account.
`email`	The email of the person you work for. Only an account signed in with that email can claim it.

The key works straight away. Send it as Authorization: Bearer $NOCLICK_API_KEY to https://api.noclick.com/v1, or to the MCP server at https://mcp.noclick.com. GET /v1/agent_signups/current shows whether a person has claimed the account yet, and what it has spent.

Until a person claims it

An account an agent made is held back until a person claims it:

It spends at most $1 a month (its spend cap). The Free plan's included usage pays for that.
It can build and run things inside NoClick: agents and their messages, workflows and their runs, AI calls, databases, repos, dicts, queues, memories, channels, volumes, secrets and webhooks.
It can't buy anything, email people, text or call them, or put anything on the public internet (apps, public endpoints, shared links, buckets, hosted MCP servers). It also can't keep inboxes, connect other services' accounts, manage keys, policy or caps, or use sandboxes or cloud browsers. Any of these fails with 409 action_required and reason: "unclaimed". The account's webhook URLs and hosted MCP links answer 403 until it's claimed, though its schedules still run.
If no one claims it within 7 days, it expires. Its keys stop working and it spends nothing more. A person can still claim it afterwards to keep what it built.

Hand it to your person

Give your person the claim URL. They open it, sign in to NoClick (or sign up), and choose Claim. The account and everything you built move into their account, your key keeps working there, and every limit is lifted. Not mine ends the account instead. Lost the URL? POST /v1/agent_signups/current/claim_link makes a new one, and the old one stops working.

If your person can't open a link, ask them for their email instead. NoClick emails them a 6-digit code that names you:

curl -fsS -X POST https://api.noclick.com/v1/humans/owner/email \
  -H "Authorization: Bearer $NOCLICK_API_KEY" -H 'Content-Type: application/json' \
  -d '{"email": "ana@example.com"}'

When they read you the code, send it:

curl -fsS -X POST https://api.noclick.com/v1/humans/owner/email/confirm \
  -H "Authorization: Bearer $NOCLICK_API_KEY" -H 'Content-Type: application/json' \
  -d '{"code": "123456"}'

The account becomes theirs, and they sign in with that email. If the email already has a NoClick account, your account folds into it. A code lasts 15 minutes. An account gets 3 codes in all, and if you named an email at sign-up, codes go only to that address.

Limits and errors

An address can make 3 sign-ups a day, and a network 10 (a /24 for IPv4, a /48 for IPv6). NoClick also takes only so many a day in all. Each sign-up that succeeds is a new account, so retry a timed-out sign-up once at most.

Status	`type`	What to do
400	`invalid_request`	Fix the field it names (`accept_terms` or `email`).
403	`permission_denied`, `reason: "not_launched"`	Agent sign-up isn't open. Ask your person for a setup code instead.
429	`rate_limited`	Wait `Retry-After` seconds, or ask your person for a setup code.
409	`action_required`, `reason: "unclaimed"`	This needs a person to claim the account first.
401	`unauthenticated`	The key no longer works: the account was declined or expired.

A setup code from a person

A person with a NoClick account copies a prompt from the console's Quickstart. It carries a one-time setup code, which you trade for a key with Full access, straight into .env:

curl -fsS -X POST https://api.noclick.com/v1/setup -d code=nc_setup_... >> .env

A code works once, within 30 minutes. See API keys.

noclick login prints a link and a short code, and the person approves it in the console. The key goes into the OS keychain. See the CLI. Without the CLI, the same sign-in is POST /v1/cli/logins and then polling POST /v1/cli/logins/token (OAuth 2.0 device authorization).

Over MCP

An MCP client connects to https://mcp.noclick.com. OAuth asks the person to sign in, choose what the connection may do, and set its monthly cap. See MCP.

How agents find this

https://noclick.com/auth.md: this page, for agents.
https://noclick.com/.well-known/agent-skills/index.json: the skills index (agentskills.io discovery).
https://mcp.noclick.com/.well-known/oauth-authorization-server: its agent_auth block names the sign-up endpoint and this page.