If you've used Agreebase before and looked for a sign-up page, a password reset, or a settings screen with an account name on it, you won't find one. This is deliberate, not an unfinished part of the product.
What Agreebase uses instead
Every action you take proves control of something you already have: an email address, a GitHub or X or Reddit account, a Telegram chat, or a device passkey. Agreebase calls this proof-of-control. There's no separate Agreebase password to create, forget, or have leaked in an unrelated breach, because there's no Agreebase-specific credential in the first place.
When you need to see your records; at /my-records, for instance; you verify a one-time code sent to your email, the same way you'd complete an email signature method. That verified email is linked to what Agreebase calls your identity graph: the set of contact points that have been confirmed as belonging to you. Records you've signed, declared, witnessed, or notarized under any of those linked contact points show up together.
Why not just have accounts
An ordinary account model asks you to create and remember a new credential purely to prove who you are to one service. Agreebase's records already need proof of identity for a different, stronger reason; signing something requires proving control of a real external identity at the moment of signing, not just logging in once. Reusing that same proof-of-control mechanism for everyday access means there's no separate login system to secure, no separate password to leak, and no account that can exist without ever having done anything: every identity in Agreebase's system has actually proven control of something at least once.
What this means day to day
- You don't need to "sign up" before creating or signing a record; the first time you prove control of an email (or other identity) is effectively your first interaction with Agreebase.
- Losing access to an email account has the same consequence it would for any service that emails you a password reset: you lose the ability to prove that identity until you regain access to it.
- Developers integrating over the API or MCP authenticate the same way underneath; see Authentication and API keys for how that maps onto bearer tokens, OAuth, and API keys for machine-to-machine use.