---
title: "Authentication — AVCodex Docs"
description: "Authentication — AVCodex documentation for AV integrators, programmers, and ops teams."
lang: en
json-ld:
---

[](/)

Solutions

[Pricing](/pricing)[The Signal](/blog)[Resources](/resources)

Learn

[Free AI Assessment](/scorecard)[Get Started →](/pricing)

[Documentation Home](/docs)

Guides 

Custom Actions 

Pro Actions 

API 

Builder API 

Agentic Commerce (ACP) 

-   [Overview](/docs/acp/overview)
-   [Authentication](/docs/acp/authentication)
-   [Agent Discovery](/docs/acp/agent-discovery)
-   [Checkout](/docs/acp/checkout)
-   [Webhooks](/docs/acp/webhooks)

Integrations 

[Docs](/docs)/ Agentic Commerce (ACP) / Agentic Commerce (ACP) 

# Authentication

Last updated · MAR 2026 · [Read as Markdown](/docs/acp/authentication.md)

ACP uses Bearer token authentication for checkout operations. Product discovery endpoints are public and need no authentication.

## [Get your ACP API key# ](#get-your-acp-api-key)

1.  Log into [app.avcodex.com](https://app.avcodex.com).
2.  Navigate to your agent.
3.  Click **Publish** in the sidebar, then **Catalog**.
4.  In the API Keys section, click **Create API Key**.
5.  Copy the key immediately. It is only shown once.

> **Note:** ACP API keys are separate from Chat API keys. They use the `acp_` prefix and are scoped to the ACP checkout endpoints.

## [Use your API key# ](#use-your-api-key)

Include your ACP API key in the `Authorization` header:

bash 

```
Authorization: Bearer acp_xxxxx
```

### [Example# ](#example)

bash 

```
curl -X POST https://app.avcodex.com/acp/{appId}/checkout_sessions \
  -H "Authorization: Bearer acp_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "line_items": [
      { "product_id": "550e8400-e29b-41d4-a716-446655440000", "quantity": 1 }
    ]
  }'
```

## [Which endpoints need auth?# ](#which-endpoints-need-auth)

Endpoint

Auth required

`GET /.well-known/agent.json`

No.

`GET /products`

No.

`POST /checkout_sessions`

Yes.

`GET /checkout_sessions/{id}`

Yes.

`POST /checkout_sessions/{id}`

Yes.

`POST /checkout_sessions/{id}/complete`

Yes.

`POST /checkout_sessions/{id}/cancel`

Yes.

## [Key format# ](#key-format)

ACP API keys always start with the `acp_` prefix, followed by 32 random characters:

code 

```
acp_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
```

Keys are stored as SHA-256 hashes. The raw key is returned only once at creation time. If you lose it, revoke the key and create a new one.

## [App scoping# ](#app-scoping)

Each API key is bound to a specific agent. The `appId` in the URL must match the agent the key was created for. If they don't match, you'll receive a `403` error.

## [Error responses# ](#error-responses)

### [401 Unauthorized# ](#401-unauthorized)

Missing or invalid token:

json 

```
{ "error": { "code": "unauthorized", "message": "Missing or invalid Authorization header" } }
```

Invalid key format (missing `acp_` prefix):

json 

```
{ "error": { "code": "unauthorized", "message": "Invalid API key format" } }
```

Key not found or revoked:

json 

```
{ "error": { "code": "unauthorized", "message": "Invalid API key" } }
```

API key has expired:

json 

```
{ "error": { "code": "expired", "message": "API key has expired" } }
```

### [403 Forbidden# ](#403-forbidden)

API key doesn't belong to the agent in the URL:

json 

```
{ "error": { "code": "forbidden", "message": "API key does not match application" } }
```

## [Rate limits# ](#rate-limits)

ACP endpoints are rate-limited per time window (1 minute):

Route type

Limit

Keyed by

Public (discovery)

200 requests/min.

Client IP.

Authenticated (checkout)

60 requests/min.

API key.

When a rate limit is exceeded, the API returns a `429` response with a `Retry-After` header indicating how many seconds to wait:

json 

```
{ "error": "Rate limit exceeded" }
```

code 

```
HTTP/1.1 429 Too Many Requests
Retry-After: 12
```

\*AVCodex · Your AV expertise. Amplified by AI.\*

Was this helpful? 

[Edit this page →](#)

[

Previous

Overview

](/docs/acp/overview)[

Next

Agent Discovery

](/docs/acp/agent-discovery)

On this page

-   [Get your ACP API key](#get-your-acp-api-key)
-   [Use your API key](#use-your-api-key)
-   [Example](#example)
-   [Which endpoints need auth?](#which-endpoints-need-auth)
-   [Key format](#key-format)
-   [App scoping](#app-scoping)
-   [Error responses](#error-responses)
-   [401 Unauthorized](#401-unauthorized)
-   [403 Forbidden](#403-forbidden)
-   [Rate limits](#rate-limits)

[](/)

The AI platform built exclusively for professional AV. Build, deploy, and sell AI tools that understand your industry.

### Platform

-   What You Can Build
-   Templates
-   [Pricing](/pricing)

### Services

-   [Done-For-You](/pricing)
-   [Academy](/academy)
-   [Contact](/contact)

### Company

-   About
-   [The Signal](/blog)
-   [Docs](/docs)
-   [LinkedIn](#)

© 2026 AVCodex. A Future Ready Holdings Inc. product. SOC 2 Type II Certified · HIPAA Compliant