---
title: "Name.ai API Authentication — OAuth 2.1 with PKCE for Agents"
description: "How to authenticate to the Name.ai API and MCP server: OAuth 2.1 authorization_code with PKCE (S256), dynamic client registration, no client secret. Optional — every read endpoint works unauthenticated; a token unlocks real marketplace prices."
url: https://name.ai/developers/auth
---

[Name.ai developer portal](https://name.ai/developers) / Authentication

# Name.ai API authentication

Authentication to the Name.ai API and MCP server is **optional**. Every read endpoint — domain search, WHOIS, TLD pricing and requirements — works with no account and no key. Completing the flow below unlocks one thing: real marketplace prices on domain search, where an anonymous caller sees them masked. The scheme is OAuth 2.1, `authorization_code` with PKCE (S256), public clients only. There is no API-key scheme.

1.  ## 1\. Discover

    Protected-resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource`, authorization-server metadata (RFC 8414) at `/.well-known/oauth-authorization-server`. An unauthenticated call to `https://name.ai/api` answers 401 with `WWW-Authenticate: Bearer resource_metadata="…"`, so one request is enough to find both.

2.  ## 2\. Register

    Dynamic client registration (RFC 7591), no approval step: `POST https://name.ai/api/oauth/register` with `{"redirect_uris": ["…"], "client_name": "…"}`. Returns a `client_id`; no client secret is issued — every client is a public client.

3.  ## 3\. Authorize

    Send the user to `https://name.ai/oauth/authorize` with `response_type=code`, your `client_id` and `redirect_uri`, a `code_challenge` (S256) and a random `state`. Codes are single-use and expire in 60 seconds.

4.  ## 4\. Exchange

    `POST https://name.ai/api/oauth/token` with `grant_type=authorization_code` and your `code_verifier`. Returns an `access_token` (30 minutes), a `refresh_token` (30 days, rotates on every use) and the scope `pricing:read`.

5.  ## 5\. Use it

    Send `Authorization: Bearer <access_token>` on MCP tool calls to the Name.ai MCP server, or on `POST https://name.ai/api/domain/search` directly. Both then return real marketplace prices instead of masked ones.


## The machine-readable version

This page is the readable twin of [name.ai/auth.md](https://name.ai/auth.md), the canonical `agent_auth` document — fetch that one from an agent. Related: [Name.ai API docs](https://name.ai/developers/api) and the [Name.ai MCP server](https://name.ai/developers/mcp).

Name.ai API Authentication — OAuth 2.1 with PKCE for Agents

---

Markdown representation of https://name.ai/developers/auth. The same URL returns HTML to any client that asks for `text/html`. Site map for agents: https://name.ai/llms.txt