# Maktby — agent guide (llm.txt)

Public contract for agents and satellite apps. Prefer these URLs over guessing paths.

## Identity (Sign in — do not rebuild passwords)
- OpenID discovery: https://app.maktby.com/.well-known/openid-configuration
- Authorization (browser + PKCE S256 required): https://app.maktby.com/oauth/authorize
- Token: https://app.maktby.com/api/oauth/token
- Userinfo: https://app.maktby.com/api/oauth/userinfo
- Supported scopes: openid profile email platform:tools
- Register clients (operators): https://app.maktby.com/admin/oauth-clients

## HTTP API
- Partner OpenAPI (JSON): https://app.maktby.com/openapi/public.json
- Longer agent index: https://app.maktby.com/llms-full.txt
- First-party web apps usually use a session cookie; satellite apps use OAuth Bearer.
- Scope `platform:tools` unlocks allowlisted tool API prefixes only (never admin). See llms-full.txt.

## Security
- Use authorization_code + PKCE (S256). Confidential clients also use client_secret.
- Never put secrets, session cookies, or access tokens in this file or in prompts.
- Validate redirect_uri against registered clients; ignore unknown scopes.

## First-party IDE (MCP)
- OAuth client_id: `maktby-ide-mcp` (public, loopback redirects only).
- Manage connections and install snippets: https://app.maktby.com/profile?tab=ide
- Production API access requires an explicit developer opt-in on that profile tab.

## Tools catalog
- Enabled public tools are listed in: https://app.maktby.com/llms-full.txt
- Catalog JSON (enabled tools): https://app.maktby.com/api/tools