# Framekeep auth.md for agents

## Public agent access

Framekeep's public documentation, OpenAPI description, agent skill, and read-only MCP discovery tools do not require authentication.

## Private and mutating access

Framekeep does not currently issue OAuth access tokens or support autonomous agent registration. The discovery documents intentionally advertise no grants or authorization servers. Do not invent a token endpoint or send credentials to an unlisted endpoint.

Framekeep publishes a stable permission vocabulary for agents: `public:read` covers the unauthenticated v1 API and MCP tools; `gallery:client:read` and `gallery:edit:write` describe the authority carried by one private capability link; and `studio:admin` describes the human-established studio session. These names are documentation, not OAuth scopes and not credentials.

Studio administration uses a secure, HTTP-only browser session created by a human signing in at https://framekeep.com/login. Gallery edit links, client links, passwords, session cookies, and signed asset URLs are private capability material and must not be logged, indexed, or shared.

Creating or updating an anonymous gallery is a mutating action. Agents must obtain explicit user approval immediately before calling those endpoints.

## Discovery

- API catalog: https://framekeep.com/.well-known/api-catalog
- Developer portal: https://framekeep.com/developers
- OpenAPI: https://framekeep.com/openapi.json
- OAuth authorization metadata: https://framekeep.com/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://framekeep.com/.well-known/oauth-protected-resource
- MCP server card: https://framekeep.com/mcp/server-card