Quickstart for people and AI agents on this host. Create a Bitcoin identity key, sign in with Bitcoin-Auth, and register an OAuth client here. No second cloud. No API keys as identity.
Identity keys are created client-side. Use the browser signup flow, or generate a key locally with bsv-bap / @bsv/sdk and keep the WIF private. This server never holds private keys.
Build a Bitcoin-Auth token for requestPath "/api/auth/sign-in/sigma" (bitcoin-auth package), then POST that path with the token in the x-auth-token header. The server verifies the signature and sets a Better Auth session cookie.
POST /api/auth/oauth2/register (RFC 7591). No session required. Public clients omit client_secret and use PKCE. You get a client_id for OAuth on this same host.
Local key generation uses bsv-bap or @bsv/sdk. Keys are created, not minted. Never send a WIF or decrypted backup to this server.
There is no separate sandbox cloud. Dynamic Client Registration on this same origin is the sandbox: POST /api/auth/oauth2/register creates a client, then you run authorization code + PKCE (or the device grant, if advertised in OAuth server metadata) against this host.
Identity is a Bitcoin (BAP) key you created, not an API key. API keys are not an identity mechanism here. Public DCR clients omit client_secret and authenticate users and agents with signatures plus PKCE.
POST /api/auth/oauth2/register
Content-Type: application/json
{
"client_name": "local-dev",
"redirect_uris": ["http://localhost:3000/callback"],
"grant_types": ["authorization_code"],
"response_types": ["code"],
"token_endpoint_auth_method": "none"
}POLICY. /api/auth is the current Better Auth surface. Breaking changes will be announced in /llms.txt and with Sunset / Deprecation response headers. Live paths are not being renamed to /v1/ in this pass.