Nineteen of the 88 services in the agent-account index document minting an API key or token by API or CLI. This page reads each one's own documentation for two things: how the first credential is obtained, and whether the key-minting call itself authenticates with a credential the caller already holds.
Read end to end — no credential, no browser, to a minted token — one of the nineteen documents it, and by its legacy login type. Two document a terminal route taking a password and a one-time code (npm and Fly.io), and both carry a caveat: Fly.io's fly auth login "Defaults to using browser-based authentication" and offers the password route as an option, while npm's npm login defaults to its web auth type and the password prompt belongs to the legacy one. 14 document a browser, dashboard or console step for the first credential, 1 documents only storing a key you already have, and 2 could not be read.
This method reads documentation, not sessions: it shows what a service claims, not that a route works, and an undocumented route is invisible to it. One criterion is a judgment and is stated as one: browser_session_required covers both docs that name a web dashboard, console or settings page as the place the first key is made, and commands the docs say open a browser. unstated is never inferred — two services' pages were unreadable to an anonymous fetch (OpenAI returned 403 to every documentation URL tried) or said nothing on either field.
15 of the 19 contradict the index's own earlier reading. An earlier sweep labelled all nineteen api_or_cli on the strength of a documented key-minting endpoint. Read for the first credential instead, 15 of them name a console or browser step: Cloudflare, Stripe, Vercel, AWS, Deepgram, Linear, Modal, MongoDB Atlas, Neon, Netlify, PayPal, Resend, Twilio, GitLab, fal.ai. A documented endpoint is not a reachable one.
Machine-readable at /first-credential.json — the same
rows with every evidence quote and the URL it came from. The 88-service index this is drawn from is at
/. Generated 2026-10-15.
| Service | What the first credential takes | Command or endpoint | Minting call needs a credential already held | Their words |
|---|---|---|---|---|
| npm | password + a code you can store password_plus_storable_code | npm token create | false | This will prompt you for your password, and, if you have two-factor authentication enabled, an otp. |
| Cloudflare | a browser session browser_session_required | dashboard: My Profile > API Tokens > Create Token | unstated | From the Cloudflare dashboard ↗︎ , go to My Profile > API Tokens for user tokens. |
| Stripe | a browser session browser_session_required | Dashboard API keys page | unstated | Use the API keys page in the Dashboard to create, reveal, expire, and rotate keys for the account or sandbox you’re viewing. |
| Vercel | a browser session browser_session_required | POST https://api.vercel.com/v3/user/tokens | true | Include the token in the Authorization header: Authorization: Bearer <TOKEN> Create and manage Access Tokens in your account settings . |
| AWS | a browser session browser_session_required | aws iam create-access-key / IAM CreateAccessKey; portal sign-in for short-term credentials | true | However, you can copy and use temporary credentials that are available in the AWS access portal. |
| Deepgram | a browser session browser_session_required | POST /v1/projects/{id}/keys (after a Console-made first key) | true | Create an API key using the Deepgram Console You must create your first API key using the Deepgram Console . |
| ElevenLabs | unstated unstated | POST /v1/service-accounts/{id}/api-keys | unstated | no quotable evidence unstated |
| Fly.io | password + a code you can store password_plus_storable_code | fly auth login (default browser-based); fly tokens create | unstated | Supports browser-based, email/password and one-time-password authentication. |
| Linear | a browser session browser_session_required | Settings > Account > Security & Access | unstated | Visit Security & access settings to create and manage them. |
| Modal | a browser session browser_session_required | modal token new | true | modal token new Create a new token by using an authenticated web session. |
| MongoDB Atlas | a browser session browser_session_required | atlas auth login; atlas organizations apiKeys create | true | --noBrowser false Don't automatically open a browser session |
| Neon | a browser session browser_session_required | neon login (opens a browser); Console > API keys | true | You'll need to create your first API key from the Console, where you are already authenticated. |
| Netlify | a browser session browser_session_required | netlify login | unstated | This will open a browser window, asking you to log in with Netlify and grant access to Netlify CLI . |
| OpenAI | unstated unstated | POST /organization/projects/{id}/api_keys (page not readable) | unstated | no quotable evidence unstated |
| PayPal | a browser session browser_session_required | POST /v1/oauth2/token with client ID and secret | true | Here's how to get your client ID and client secret: Select Log in to Dashboard and log in or sign up. |
| Resend | a credential you already hold existing_credential_required | resend login --key; POST /api-keys | true | resend login Authenticate by storing your API key locally. |
| Twilio | a browser session browser_session_required | POST /2010-04-01/Accounts/{AccountSid}/Keys.json | true | You can create Main keys only in the Twilio Console (link takes you to an external page) . |
| GitLab | a browser session browser_session_required | user profile > Access tokens | unstated | To create a personal access token: In the upper-right corner, select your avatar. Select Edit profile . In the left sidebar, select Access > Personal access tokens . |
| fal.ai | a browser session browser_session_required | POST /v1/keys; fal.ai/dashboard/keys | true | Go to the Dashboard Navigate to fal.ai/dashboard/keys 2 Generate a Key Click Create Key |
The key-minting call is documented as needing a credential already held for 10 of the nineteen; 1 documents a password prompt, and 8 state nothing either way.