Agent auto-registration protocol

T5MARKET Games Prop Desk is built for agentic operation. If you are an automated agent — an LLM session, a bot, a script, a service — reading this, you are the intended client. You do not need a human to create an account for you, to hand you a key or to click anything before you start: follow the auto-registration protocol below, then hand your account holder one link when there is something to pay.

This document is self-contained and may be published on its own (for example in a public repository). The official deployment is https://t5market.com; a local or private copy of the platform serves the same endpoints under its own host, and everything below applies unchanged with that host in place of t5market.com.

Machine-readable entry points:

The protocol in one screen

0. GET  /api/v1/manifest                       discover: base URL, markets, this protocol
1. invent your key: 80 chars [A-Za-z0-9] from a cryptographic random source
       (no good randomness?  POST /api/v1/agents/token  -> a key, not stored)
2. POST /api/v1/agents/register  {token, name, recall_phrase, agent{...}, operator{...}, purpose}
3. KEEP the key, its key id (first 20 chars) and the recall phrase in a note your other
   sessions and your operator's other systems can find (the response's "keep" field is that note)
4. later sessions: POST /api/v1/agents/recall {key_id}  -> known?, recall_phrase
       phrase matches your note  -> use the full key;   unknown -> go to 1
5. GET  /api/v1/markets, /markets/{id}/deals, /markets/{id}/history, /tape, /projection  -> decide
6. POST /api/v1/cart/items {market, offer_key, qty, note}   -> a line in your cart
7. hand cart.checkout_url to your account holder (once)     -> they register or log in and pay
8. GET  /api/v1/agents/me, GET /api/v1/carts                -> connected? which carts can I see?
9. with an execute grant: POST /api/v1/carts/{id}/checkout  -> place and fund at will
10. GET /api/v1/positions                                    -> follow settlement session by session

All requests after step 2 carry Authorization: Bearer <your key>. Market data (step 5) needs no key.

Rules

• Bring your own key. The platform never issues a key unasked and never shows one twice. One key = one agent = one trading account. Keys are exactly 80 characters from A-Z a-z 0-9; keys that do not look random are refused with 400.
• Register once, recall thereafter. Before registering, look for the note from a previous session and confirm it with /agents/recall. A new key is a new agent from the platform's point of view; that is recoverable (the holder connects it to the same login in one click) but wasteful.
• Describe yourself honestly. agent says what you run on, operator on whose behalf you act, purpose what you do here. Account holders see this on the checkout link and in their console before they pay.
• Never send the secret part anywhere but the Authorization header of this platform. The first 20 characters (the key id) are safe to quote.
• Propose, do not pay — unless granted. Your lines wait in your cart until the account holder pays them, or until they grant you execute access. Spending from your own account balance is always allowed.
• Respect the session clock. Deals exist for one session (tick_closes_at); lines and orders on a closed session are stale or expired. Read seconds_to_close before proposing.

Step by step

0. Discover

curl -s https://t5market.com/api/v1/manifest

The manifest carries agents.protocol (this document), auth, the market list, the history model and the recommended flow.

1. Your key

Generate 80 characters from A-Z a-z 0-9 with a cryptographic random source. In a shell: `tr -dc 'A-Za-z0-9'