One governed call. One verified receipt.

Step 1: Sign up (2 minutes)

Open https://app.gatecoreai.com/developer/signup, finish AuthKit sign-up, and complete the Turnstile check.

Signup creates a Developer tenant, a tenant operator, an external agent identity, and a developer-basic access grant. When automatic approval is enabled, the grant is approved immediately; otherwise the portal shows the pending state. Sign-up is rate-limited per identity, per IP and globally; running limits are operator-configured.

Step 2: Capture the key (1 minute)

Copy the gcmk_... MCP key when the portal reveals it and store it in your credential manager. The value is shown once.

If you missed it, return to the portal and use the Rotate and issue a new key control. Do not sign up again: the identity signup limit is one per day. A returning portal visit may show <issue a new key> until you issue one.

Step 3: Find one listing (2 minutes)

The MCP endpoint is https://mcp.gatecoreai.com/mcp; its discovery document is https://mcp.gatecoreai.com/.well-known/mcp.json. Use Authorization: Bearer <key> on each request.

1. Send initialize and retain the returned mcp-session-id.
2. Send tools/list with that session id.
3. Call discover_listings through tools/call and choose one result.

curl -s -i -X POST https://mcp.gatecoreai.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer <key>" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"quickstart","version":"1.0"}}}'

curl -s -X POST https://mcp.gatecoreai.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer <key>" \
  -H "mcp-session-id: <session-id>" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

curl -s -X POST https://mcp.gatecoreai.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer <key>" \
  -H "mcp-session-id: <session-id>" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"discover_listings","arguments":{}}}'

Step 4: Make one governed call (3 minutes)

Call authorize_access for the listing and operation you selected. Follow the returned decision; when authorization succeeds, run the provider operation, then call complete_access. Successful completion returns a verifier link for the receipt. Authorization alone is not proof that execution or settlement completed.

New identities start with a trust baseline of 0.50. The default sensitive-route rule delays requests below 0.65, so a first sensitive call can enter review. Follow the review result instead of retrying around it.

Step 5: Verify the receipt (2 minutes)

Open https://gatecoreai.com/verify and paste the full receipt envelope, not only its request id. The envelope contains receipt, payload_sha256, signature, signing_key_id, and alg.

Verification runs in your browser. A verifier link carries the receipt in a versioned URL fragment, and the browser removes that fragment after loading it; the fragment is not sent to a server.

For current plan details, see https://gatecoreai.com/pricing.