# Why there's no account to create

> Agreebase doesn't use usernames or passwords. Here's what replaces an account, and why.

Audiences: users, developers, agents
Kind: concept
Updated: 2026-07-22

If you've used Agreebase before and looked for a sign-up page, a password reset, or a settings screen with an account name on it, you won't find one. This is deliberate, not an unfinished part of the product.

## What Agreebase uses instead

Every action you take proves control of something you already have: an email address, a GitHub or X or Reddit account, a Telegram chat, or a device passkey. Agreebase calls this proof-of-control. There's no separate Agreebase password to create, forget, or have leaked in an unrelated breach, because there's no Agreebase-specific credential in the first place.

When you need to see your records; at `/my-records`, for instance; you verify a one-time code sent to your email, the same way you'd complete an email signature method. That verified email is linked to what Agreebase calls your identity graph: the set of contact points that have been confirmed as belonging to you. Records you've signed, declared, witnessed, or notarized under any of those linked contact points show up together.

## Why not just have accounts

An ordinary account model asks you to create and remember a new credential purely to prove who you are to one service. Agreebase's records already need proof of identity for a different, stronger reason; signing something requires proving control of a real external identity at the moment of signing, not just logging in once. Reusing that same proof-of-control mechanism for everyday access means there's no separate login system to secure, no separate password to leak, and no account that can exist without ever having done anything: every identity in Agreebase's system has actually proven control of something at least once.

## What this means day to day

- You don't need to "sign up" before creating or signing a record; the first time you prove control of an email (or other identity) is effectively your first interaction with Agreebase.
- Losing access to an email account has the same consequence it would for any service that emails you a password reset: you lose the ability to prove that identity until you regain access to it.
- Developers integrating over the API or MCP authenticate the same way underneath; see [Authentication and API keys](/docs/developers/authentication-and-api-keys) for how that maps onto bearer tokens, OAuth, and API keys for machine-to-machine use.