# Machine access (https://prood.com/docs/guides/machine-access)

Prood has one API for people, services and AI agents:

- **OpenAPI:** `GET https://prood.com/v1/openapi.json`
- **Reference:** [Commerce API](/docs/api)
- **TypeScript client:** `@prood/api-client`, available from the source repo for now
- **MCP:** `POST https://prood.com/mcp`
- **Agent Auth:** `GET https://prood.com/.well-known/agent-configuration`
- **CLI:** `prood`, available from the source repo for now

## API keys [#api-keys]

Create keys in the dashboard, under **Connections**, then **API keys**. Each key belongs to one organization and is shown once.

| Scope | What it does |
| --- | --- |
| **Storefront** | Browse products, fill a cart and place an order. Payment runs on hosted checkout, started from the store |
| **Admin** | Reads and changes catalog, inventory, orders and store settings, and reads customers. Payment accounts, domains, team and keys stay in the dashboard. Starts on Grow. |

Keys start with `pk`, followed straight away by random letters and numbers, with no underscore: `pkAbC123...`.

Free API keys reach the public storefront API: catalog, carts and placing orders. Reading your orders and customers by API, and all admin writes, start on Grow.

Use the key with REST, MCP or the CLI:

```bash
curl -H "x-api-key: $PROOD_API_KEY" https://prood.com/v1/me
```

Errors come back as JSON: `{ "code": "UNAUTHORIZED", "message": "Invalid API key. It may be mistyped, or it may have expired. Create a new one in your dashboard, under API keys." }`.

## Agent Auth [#agent-auth]

With Agent Auth, an AI agent starts with nothing until you approve it for your store. After that it keeps the public catalog, and anything else needs your approval. You see every capability the agent asks for and approve or deny the request as a whole. Approving anything that changes your store needs a sign-in from the last 10 minutes. Approved access ends after an hour idle, or 24 hours at most. Then the agent asks again. You see and revoke approved agents under **Settings → API keys**.

An API key isn't Agent Auth: anything holding an admin key can do what the key allows, without asking.

Agent Auth is coming with Grow.

Agents discover the provider configuration:

```bash
curl https://prood.com/.well-known/agent-configuration
```

Every OpenAPI `operationId` becomes an Agent Auth capability. Direct REST calls use a bearer token:

```bash
curl -H "Authorization: Bearer eyJ..." https://prood.com/v1/products
```

See [Agent Auth](/docs/apps/api/agent-auth) for the full flow.

## MCP [#mcp]

MCP tools use the same names as OpenAPI operation IDs. Free keys reach the 21 storefront tools.

```json
{
  "mcpServers": {
    "prood-commerce": {
      "url": "https://prood.com/mcp",
      "headers": {
        "x-api-key": "pkAbC123..."
      }
    }
  }
}
```

## TypeScript client [#typescript-client]

```ts
import { createCommerceApiClient, unwrap } from '@prood/api-client'

const api = createCommerceApiClient({
  baseUrl: 'https://prood.com/v1',
  apiKey: process.env.PROOD_API_KEY,
})

const caller = await unwrap(api.GET('/me'))
```

## CLI [#cli]

```bash
prood auth whoami --api-url https://prood.com/v1 --api-key "$PROOD_API_KEY" --json
prood products list --api-url https://prood.com/v1 --api-key "$PROOD_API_KEY" --json
prood mcp config --api-url https://prood.com/v1 --api-key "$PROOD_API_KEY"
prood openapi sync --check
```