Q: How fast can I make my first verified call?
A: Under five minutes. Create a sandbox API key from the Network console, run the cURL / Node / Python sample on /network/sandbox, and watch the OTP webhook fire on requestbin.com. Live keys are unlocked after a short compliance review.

Q: Does ZenoXCare support MCP and agent-to-agent (A2A) protocols?
A: Yes. Three read-only Verification Network MCP tools are registered (read_integration_status, read_usage_summary, read_verification_status). They are tenant-scoped, require auth + network eligibility, and return redacted snapshots so AI agents (Cursor, Claude Desktop, ChatGPT) can answer questions without holding session cookies.

Q: How are webhooks secured?
A: Every webhook is signed with HMAC-SHA-256 over the raw body. The X-ZenoXCare-Signature header carries the signature; verify with timingSafeEqual. Signing keys are rotatable from the Network console with a 24-hour grace window.

Q: What's the rate limit, and how do I handle it?
A: 60 requests / minute on sandbox keys. 429 responses include Retry-After. Build with idempotency-key on POST /verify so retries are safe. Live limits are negotiated per partner.

Q: Where's the OpenAPI / SDK?
A: OpenAPI 3.1 lives at /api/public/openapi.json. The TypeScript SDK ships as @zenoxcare/sdk on npm. Other languages are generated from the same OpenAPI; raise an issue if your language is missing.