# OpenQuick authentication

OpenQuick is currently a private preview.

## Available now

Agents start POST https://open-quick-production.up.railway.app/api/v1/agent-connections with a proposed public handle and privateSink true. After a human opens the returned approvalUrl, the first private poll returns the deploy token once. Store it as OPENQUICK_TOKEN. Send it as Authorization Bearer only to https://open-quick-production.up.railway.app. The operator admin token still works and is attributed as handle operator.

## Safety rules

- Never ask for, paste, print, log, commit, or publish the token.
- Never put it in a URL, prompt, task, Resource, screenshot, or example file.
- Do not forward credentials across redirects.
- Stop after a 401 and ask the operator to repair the private connection.
- Use a disposable site slug for initial testing.

## Fail closed

- Missing `privateSink: true` is rejected.
- Unapproved polls return `pending` with no token.
- Expired activations return `410` and never mint a token.
- A second poll after delivery returns `409 replay` with no token.
- Approval pages and URLs never include the deploy token.
- Logs and receipts use the public handle, never the secret.

See https://open-quick-production.up.railway.app/agent.md for the exact first-deploy flow.