# limrun.com auth.md

How AI agents authenticate with Limrun APIs.

## Who this is for

Agents (and agent frameworks) that want to use Limrun cloud iOS simulators,
Android emulators, and remote build sandboxes programmatically, either through
the MCP server at https://mcp.limrun.com/mcp or the REST API at
https://api.limrun.com.

## OAuth 2.0 (recommended for MCP)

The authorization server is https://api.limrun.com. Discovery metadata:

- Authorization server metadata: https://api.limrun.com/.well-known/oauth-authorization-server
- Protected resource metadata (this site): https://limrun.com/.well-known/oauth-protected-resource
- Protected resource metadata (MCP): https://mcp.limrun.com/.well-known/oauth-protected-resource

Supported flow: authorization code with PKCE (`S256`), public clients
(`token_endpoint_auth_methods_supported: ["none"]`), refresh tokens, and the
`mcp` scope.

### Agent registration

Dynamic client registration is available, no manual onboarding needed:

1. POST your client metadata (RFC 7591) to
   https://api.limrun.com/authn/oauth/register. Client ID metadata documents
   are also supported (`client_id_metadata_document_supported: true`).
2. Send the user through https://api.limrun.com/authn/oauth/authorize with
   PKCE and `scope=mcp`.
3. Exchange the code at https://api.limrun.com/authn/oauth/token.
4. Use the access token as `Authorization: Bearer <token>` against
   https://mcp.limrun.com/mcp.

Tokens can be revoked at https://api.limrun.com/authn/oauth/revoke.

MCP-aware clients get all of this automatically: connect to
https://mcp.limrun.com/mcp, follow the `WWW-Authenticate` challenge to the
protected resource metadata, and complete the flow.

## AgentID sign-in

An agent with an AgentID can choose **Continue with AgentID** on the
[Limrun sign-in page](https://console.limrun.com/authn/login). The agent signs
in with its own verified email address. Existing signup restrictions still apply;
this does not grant access to the owner's Limrun account.

The Get started page shows the skill installation command and lets you create
an API key, then copy a `lim set-api-key` command. Run both commands in your
agent's terminal to set up cloud builds and device testing.

During MCP authorization, choose AgentID on the sign-in page opened by that
flow so Limrun can resume the pending authorization.

## API keys (REST API and lim CLI)

Create an API key in the [Limrun Console](https://console.limrun.com) under
your organization's token settings, then send it as
`Authorization: Bearer <key>` to https://api.limrun.com.

## More

- Documentation: https://docs.limrun.com/docs
- MCP server guide: https://docs.limrun.com/docs/agents/remote-mcp
- API catalog: https://limrun.com/.well-known/api-catalog