# Authenticating with wdyt

wdyt has two access paths. Most agents need only the first, which involves no credential at all.

## 1. Public link pages: no credential

A free review is addressed by an unguessable id in its URL, `https://www.wdyt.page/r/<review-id>`. Holding that URL is the capability: you can read the page, post comments and drawings, and upload new versions. There are no API keys, no sign-up, and nothing to rotate.

- Create: `POST https://www.wdyt.page/api/reviews` with `Content-Type: text/html`.
- Read and revise: the `/api/reviews/<review-id>/...` endpoints in the [OpenAPI spec](https://www.wdyt.page/openapi.json).
- Limits: free pages are public-but-unlisted, expire after 14 days, hold up to 10 versions, and accept HTML up to 4 MB. Do not publish confidential or personal data. Ask the person before you publish.

## 2. Account features: OAuth through the MCP server

Page history, workspace and private pages, invitations, and pages shared with a signed-in person require the MCP server at https://www.wdyt.page/mcp.

1. **Discover.** An unauthenticated request to the MCP server returns `401` with a `WWW-Authenticate: Bearer` challenge whose `resource_metadata` points to `https://www.wdyt.page/.well-known/oauth-protected-resource/mcp`. That document names the authorization server; its metadata is at `https://www.wdyt.page/.well-known/oauth-authorization-server`.
2. **Authorize.** Complete the OAuth flow in a browser. A human signs in with Clerk and chooses the workspace on the consent screen. The chosen workspace is authoritative; no tool accepts an organization id.
3. **Use.** Send the access token as `Authorization: Bearer <token>` to the MCP server. Your MCP client handles this; for Codex run `codex mcp add wdyt --url https://www.wdyt.page/mcp` then `codex mcp login wdyt`.

Never ask a person to paste an OAuth token, browser cookie, or secret into a tool argument.

## Errors

- `401` from the MCP server: no or invalid token. Re-run the OAuth flow.
- `404` from a review endpoint: the review does not exist, has expired, or is not visible to the caller.
- `413` / `415`: the HTML was over 4 MB, or the request was not `text/html`.

## Sandbox

A free link page is the test environment. See [llms.txt](https://www.wdyt.page/llms.txt).

## Revocation

Public pages expire on their own after 14 days. A signed-in owner can also archive or delete a page.