Access

Calling the agent surface

The public agent endpoints do not require an API key today. There is no self-serve key issuance, and the service does not publish a key-request page. If you are building an integration and need one provisioned, contact support@reach.dog.

When a key is issued to you, send it in the X-API-Key header:

curl -X POST https://agents.reach.dog/a2a/router \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{ ... }'

The header name is configurable per deployment. X-API-Key is the default and the value in use.

Identity on the Gemini Enterprise path

Gemini Enterprise does not use an API key. When an authorization is connected to the registered agent, requesting the openid and email scopes, Gemini forwards an OAuth access token with each turn.

That token is resolved once against Google's UserInfo endpoint to learn which account is asking, and the result is cached briefly. The stable Google subject id is the identifier; email is carried for display and nothing is keyed on it. The token is never written to a log.

Identity is used for one thing: keeping each person's uploaded catalogs separate and available across conversations. It is not an authorization decision. See Add the Reach Agent.

Rate limit headers

Every response carries the current usage window:

Header	Meaning
X-RateLimit-Limit	Requests allowed in the current window
X-RateLimit-Remaining	Requests left in the window
X-RateLimit-Reset	ISO date the window resets

Read these headers rather than assuming a fixed number. Counters are per calling key and per serving instance, so the headers are the only accurate view your client has.

When a limit is reached, the response is a JSON-RPC error stating current usage and the reset date. No further requests are processed until the window resets.

Errors

Errors are sanitized by design. Client-facing messages state what went wrong in plain language. System prompts, tool schemas, queries, table names, and stack traces stay in our logs and never appear in a response. Error codes are listed in JSON-RPC format.