​

Authenticate with the EvalGate API

​

Create an account

• EvalGate does not ask for a separate email/password pair.
• The social sign-in flow does not send a separate EvalGate verification email.
• No payment card is required for Developer’s 1,000-result monthly allowance.
• Paid tiers and Developer overage continue at $1 per 1,000 additional results without a default usage or dollar cap.
• Social sign-in requires JavaScript and an interactive browser for the person proving identity. An agent can initiate a credential handoff over HTTP, but a signed-in organization admin must still approve the organization and scopes.

​

Organization single sign-on and two-factor authentication

• Verified domains. Claim an email domain, publish the TXT record EvalGate shows at _evalgate-domain-verification.<domain>, then verify. Only verified domains route sign-in to your identity provider.
• SSO providers. Connect a SAML 2.0 identity provider (IdP metadata XML, or entity ID, SSO URL, and signing certificate) or an OpenID Connect provider (issuer, client ID, client secret). The client secret is stored encrypted and is not shown again. Members sign in from the login page by entering their work email under single sign-on. A first SSO sign-in adds the person to the organization with the role you choose for new SSO members (Viewer by default). Use Generate callback URLs before registering the application in Okta or Entra, copy the exact URLs into the IdP, and keep the page open until you have saved the client credentials. The planned ID is not saved until registration succeeds; reloading requires restarting setup or reusing that ID through the API.
• Require SSO. Members whose email domain you verified must sign in through your identity provider; GitHub and Google sign-in is refused for those addresses, and existing non-SSO sessions lose access to the organization. You can designate one owner as a recovery admin who may still sign in without SSO, but only with a verified two-factor code.
• Require two-factor authentication. Every member must enroll an authenticator app (TOTP) and verify it in each session before reaching the organization. Backup codes are issued once at enrollment. You can choose to accept your identity provider’s MFA for SSO sign-ins instead.

​

EvalGate keys and provider keys are different

​

Create an API key

​

Agent and CLI setup

evalgate login
evalgate whoami
evalgate link
evalgate status

evalgate status --json

curl -X POST https://www.evalgate.com/api/agent-setup/start \
  -H 'Content-Type: application/json' \
  --data '{"client_name":"repository assistant","requested_scopes":["eval:read","runs:read","traces:write"]}'

​

Agentic registration with a human approver

​

Use the API key in HTTP requests

Authorization: Bearer YOUR_API_KEY

curl https://evalgate.com/api/traces \
  -H "Authorization: Bearer sk_test_your_api_key_here" \
  -H "Content-Type: application/json"

​

Configure environment variables

EVALGATE_API_KEY=sk_test_your_api_key_here
EVALGATE_ORGANIZATION_ID=00000000-0000-4000-8000-000000000001

​

SDK auto-loading

import { AIEvalClient } from '@evalgate/sdk';

const client = AIEvalClient.init();

from evalgate_sdk import AIEvalClient

client = AIEvalClient.init()

const client = new AIEvalClient({
  apiKey: process.env.EVALGATE_API_KEY,
  organizationId: process.env.EVALGATE_ORGANIZATION_ID,
});

import os
from evalgate_sdk import AIEvalClient

client = AIEvalClient(
    api_key=os.environ["EVALGATE_API_KEY"],
    organization_id=os.environ["EVALGATE_ORGANIZATION_ID"],
)

​

Authentication errors

• The Authorization header is present and formatted as Bearer YOUR_API_KEY.
• The key was copied in full.
• The key has not been deleted from the Developer Dashboard.
• The key scopes include the operation you’re attempting.

​

Security best practices

echo ".env" >> .gitignore

env:
  EVALGATE_API_KEY: ${{ secrets.EVALGATE_API_KEY }}
  EVALGATE_ORGANIZATION_ID: ${{ secrets.EVALGATE_ORGANIZATION_ID }}

​

Rate limits