Authentication

The library is public

Use cases and bot templates can be read without a key. Sign-in is for sponsor bookings, administration, and optional API key management. MMB charges sponsors; reader upgrades are disabled.

Optional library keys

Sign in to create a key in API access. A key with library:read can read either collection and inspect its own usage. Anonymous keys can also read both collections within their lifetime and rate limits.

• POST /api/v1/auth/agent mints an anonymous key and returns a claim token. Save the key when shown.
• POST /api/v1/auth/claim accepts claimToken and email to send a verification code.
• POST /api/v1/auth/claim/complete accepts claimToken, email, and code. Claiming preserves the key and enables account quotas.
• GET /api/v1/usage requires a bearer key and returns account usage.

Sponsor and administrator keys

The sponsor workspace creates named, scoped keys. Use only the scopes an integration needs. A key cannot grant scopes it does not have; admin scopes also require current admin membership. See the scope table.

curl "$MMB_BASE_URL/api/v1/sponsors/me" \
  -H "Authorization: Bearer $MMB_API_KEY"

Cookie-authenticated changes require the same origin. Bearer-authenticated requests work without a browser. Revocation takes effect immediately.

Legacy upgrade routes

Starting a reader upgrade now returns 409 library_is_free. Existing payment settlement and receipt handling remain available for historical records. New payments belong to sponsor bookings.