> ## Documentation Index
> Fetch the complete documentation index at: https://agenticadvertisingorg-snap-format-preview-links.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# L2 — Auth & registry

> Auth-and-registry layer of the AdCP stack. Turns a verified identity into a scoped principal — which buyer, which brand, which advertiser account, which sandbox-vs-live tier.

L2 turns a verified identity into a scoped principal. On the agent side: multi-tenant principal resolution, sandbox/live boundary, brand resolution, permission scoping. On the caller side: publish own identity, look up the agent it's calling — much smaller surface.

## What an SDK at L2 must provide

If you're picking an SDK or porting one to a new language, this is the L2 build target:

* **An account-store abstraction** that resolves an authenticated principal to a scoped account, with hooks for multi-tenant routing.
* **Authentication primitives** for at least API-key and bearer-token shapes, plus a way to compose them.
* **Brand-resolution / agent-registry lookup** — or a documented extension point if the SDK doesn't ship it natively.
* **The sandbox-vs-live account flag**, enforced at the SDK boundary so the conformance-test surface refuses to dispatch on production accounts.

For the cumulative cross-layer story (what L0+L1+L2 buys you), see the [SDK stack reference](/docs/building/cross-cutting/sdk-stack#l2--auth--registry).

## Pages in this layer

* **[Authentication](/docs/building/by-layer/L2/authentication)** — credentials and permissions.
* **[Account state](/docs/building/by-layer/L2/account-state)** — multi-tenant account resolution.
* **[Accounts and agents](/docs/building/by-layer/L2/accounts-and-agents)** — relationship between account scoping and agent identity.
* **[Context & sessions](/docs/building/by-layer/L2/context-sessions)** — managing principal state across requests.