Authentication

Agent credentials are hashed API keys with explicit scopes. Money-moving POSTs require Idempotency-Key.

Keys

• Agent: bk_agent_live_… / bk_agent_test_…
• Merchant (checkout-only legacy): bk_live_…
• Header: X-Api-Key or Authorization: Bearer

Scopes

• agent:pay — instant payments
• agent:balance:read
• agent:escrow:fund / agent:escrow:release
• agent:mandate / agent:read
• checkout:write — create Buy with Bruce sessions

PIN vs policy

Interactive browser spends use a short-lived PIN grant. Agent keys are PIN-exempt and instead must satisfy the spend policy engine and session signer.

Idempotency

Required on POST /payments, escrow creates, x402 settle, and A2A payment-submitted. Replays with the same key and body return the stored response (KV + D1).