# auth.md — how an AI agent gets access to Shager

Shager lets an agent register itself. The agent gets a **sandbox** immediately; a **human claims it** before anything is published or any social account is connected.

## 1. Discover
- MCP server: https://app.shager.ai/api/mcp (Streamable HTTP) · server card: https://app.shager.ai/api/mcp/server-card
- REST API: https://app.shager.ai/api/v1 · OpenAPI: https://app.shager.ai/api/v1/openapi.json
- Docs for agents: https://shager.ai/md/en/agents

## 2. Register (anonymous, no human needed)
```http
POST https://app.shager.ai/api/v1/agent/signup
Content-Type: application/json

{ "agent_name": "Acme marketing agent (Claude)", "contact_email": "owner@acme.com", "purpose": "Distribute weekly videos to our 40 branch pages" }
```
Response (201): `data.api_key` (shown once), `data.claim_url`, `data.mcp_url`, `data.expires_at`.
Limits: 5 sign-ups per hour per address; sandboxes expire after 7 days unless claimed.

## 3. Use
Send `Authorization: Bearer <api_key>` to the MCP server or the REST API.
In the sandbox you may: create workspaces (max 5), upload media from URLs, create draft posts, list and read.
You may NOT (until claimed): schedule or publish, create client connect links, send approval requests.

## 4. Claim (the human)
Give `claim_url` to your human (it is also emailed to `contact_email`). They sign in and become the owner. They choose whether your key may also schedule and publish (scope `publish`).

## 5. Then
- `create_connect_link` → the account owner connects Facebook/Instagram/YouTube with a link (no Shager account needed).
- `create_post` with `schedule_at` (or `schedule_post`) → staggered publishing per account.
- `get_post`, `get_analytics` → delivery state and clicks per account.

## 6. Revoke
The human revokes keys at https://app.shager.ai/dashboard/agents. Every agent action is listed there (audit log).

## Rules
- 120 requests per minute per key. Errors: `{ "error": { "code", "message" } }`.
- Vary captions per account (`per_channel`); identical mass posts look like spam. Publishing is always staggered.
- Official network APIs only. Never post to accounts the human is not authorized to manage.

Contact: yaniv.presler@gmail.com