Build a verified connection to AELIA.

1. Apply and verify ownership

Submit an application at collab.aeliaai.org.ng. AELIA sends an email verification link to the named organization contact and provides a unique DNS TXT challenge.

Type: TXT
Host: _aelia-verification.example.com
Value: aeliaai-verification=<unique-token>

Verify the contact email and DNS record. The request then enters manual AELIA review. No integration key is issued before both proofs pass.

2. Approval and credentials

After approval, AELIA issues a partner API key with only the approved scopes. Keys are stored as hashes, shown once to the administrator, expire after 90 days and can be revoked. Store the key in a server-side secret manager.

Authorization: Bearer aelia_live_...

Never place keys in browser code, mobile bundles, public repositories, URLs or logs.

3. REST API

Base URL: https://api.aeliaai.org.ng/v1/collab/v1

GET  /health
GET  /capabilities
POST /chat
POST /agents/run

Every request requires an approved partner key. Requests are limited to 60 per minute per credential. The credential must contain the endpoint's scope.

Example: health check

curl https://api.aeliaai.org.ng/v1/collab/v1/health \
  -H "Authorization: Bearer $AELIA_API_KEY"

Example: chat

curl -X POST https://api.aeliaai.org.ng/v1/collab/v1/chat \
  -H "Authorization: Bearer $AELIA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message":"Summarize this integration request."}'

4. Available scopes

• platform:read — authenticated health status.
• capabilities:read — capability discovery.
• chat:execute — submit messages to AELIA chat.
• agents:run — run approved AELIA agents.

Requested permissions are not automatically granted. AELIA reviews and grants only the permissions approved for the organization.

5. MCP endpoint

Endpoint: https://mcp.aeliaai.org.ng/mcp. The service supports MCP Streamable HTTP discovery and tool calls. Partner execution requires the same approved partner credential, with chat:execute or agents:run as applicable.

The exact supported MCP client transport/version should be tested against your client before production rollout.

6. Security and lifecycle

• DNS TXT proof and contact email verification are both mandatory.
• Human approval is mandatory; no automatic approvals.
• Credentials are hashed at rest and expire after 90 days.
• Each key is restricted to approved scopes.
• Rate limiting and audit events are applied to partner API calls.
• Administrators can reject, suspend or revoke an integration.

Report security concerns to security@aeliaai.org.ng.