# Sign up from an agent

> Documentation index: [llms.txt](https://westkite.com/docs/llms.txt). Every page is also at its URL plus `.md`.

An agent can start a West Kite account for a person, or connect to the account they already have. The account belongs to the person: the agent starts it, and the person finishes it in about a minute.

The person always chooses their own password, agrees to the terms and approves the connection. There's no anonymous access.

## Which way in

- **The client supports MCP OAuth** (Claude Code, Codex, Cursor and others): [add the server](https://westkite.com/docs/connect.md) and let it open the browser.
- **The agent drives a browser:** open `https://app.westkite.com/sign-up#login_hint=<email>&first_name=<name>&last_name=<name>` to fill in the form for them.
- **The agent can only make HTTP requests**, or runs somewhere with no callback: follow the steps below.

## 1. Start the connection

```sh
curl https://app.westkite.com/agent/identity \
  -H 'Content-Type: application/json' \
  --data '{"type":"service_auth","login_hint":"pat@example.com","first_name":"Pat","last_name":"Lee","client_name":"Property research agent"}'
```

Ask the person before sending their email. `login_hint` and the names are optional, but with `login_hint` only that person's account can finish, sign-up is filled in for them, and they won't need a code from you.

The response has a `claim_token`, which you keep to yourself, and a `claim` with a `verification_uri`, a `user_code` and a polling `interval`.

## 2. Hand it to the person

If you sent their email, send just the link:

> Open this link to connect me to West Kite: sign up or sign in, then select Allow.
>
> https://app.westkite.com/agent/claim?attempt=…

Without `login_hint`, the page also asks for the `user_code`, so add "and enter this code: **123456**". Use the `verification_uri` exactly as returned. Codes go in that page, not back to you.

## 3. Wait for approval

```sh
curl https://app.westkite.com/oauth/token \
  --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \
  --data-urlencode 'device_code=<claim_token>'
```

Repeat every `interval` seconds. You'll get `authorization_pending` until they finish. `slow_down` means wait longer, `access_denied` means they declined, and `expired_token` means the 10 minutes ran out, so start again.

Once they approve, you get an `access_token` and a `refresh_token`. Store both somewhere private.

## 4. Use West Kite

Connect to `https://app.westkite.com/mcp` over Streamable HTTP with `Authorization: Bearer <access_token>`, then [look up a property](https://westkite.com/docs/property-lookup.md).

When the token expires, refresh it at the same token endpoint with `grant_type=refresh_token`. Refresh tokens rotate, so keep the new one. The person can disconnect the agent at any time in Connect AI.

The full contract, including every error, is in [auth.md](https://app.westkite.com/auth.md).