API & agent access

Two things don't require a login: a health check at GET /api/health, and the MCP server at /api/mcp (JSON-RPC 2.0, Streamable HTTP transport). Without auth it exposes three read-only tools — get_product_info, get_pricing, and get_faq; with an API key it adds eight account tools that plan, create, monitor, and export overlay packs (see /docs/agents). Everything else that writes data or spends money — starting a render from the web app, creating a checkout session, touching your dashboard — requires a signed-in session or one of those keys.

AlertForge accounts are created and authenticated through the web app (/signup / /login) via Supabase Auth — email/password, magic link, or Google sign-in. Sessions are Supabase-issued JWTs carried in browser cookies. A self-serve API-key flow now exists separately, for a third-party agent to act on a user's behalf — mint one at /dashboard/agents and see /docs/agents for setup. The full, honest account of the dashboard's own session auth — including the real OAuth discovery metadata and its one known gap — lives at /auth.md.

• /openapi.jsonOpenAPI 3.1 — the two documented HTTP operations above, with real prices
• /.well-known/api-catalogAPI catalog (RFC 9727) — links this page, the OpenAPI doc, and the health check together
• /.well-known/mcp/server-card.jsonMCP server card — describes the live /api/mcp endpoint
• /.well-known/oauth-protected-resourceProtected resource metadata (RFC 9728) — points to the real token issuer
• /.well-known/openid-configurationOIDC discovery — mirrors the real Supabase Auth issuer's metadata
• /auth.mdauth.md — honest, human-readable auth status
• /.well-known/agent-skills/index.jsonAgent Skills index — step-by-step skills for building a pack and reading pricing
• /llms.txtllms.txt — whole-site fact sheet for AI agents

Ultra-tier "API access" today means render automation we set up directly with agencies and high-volume customers, not a public self-serve surface. If you're building something that needs real API or agent access, email [email protected] — we'd rather talk through a real integration than publish one that doesn't work yet.