---
title: "auth.md for foto foto"
description: "No OAuth server and no API keys: creating a photo book is public, one book is reached with its private token, and the customer verifies their email on foto foto to own it."
canonical: https://fotofoto.app/auth.md
---

# auth.md for foto foto

foto foto has no OAuth server and no API keys. Creating a photo book is public. Access to one book is a private per-book token returned when that book is created. Ownership is established by the customer verifying their email on foto foto, never by the agent.

## Discover

- Service documentation: https://fotofoto.app/connectors.md
- OpenAPI description: https://fotofoto.app/connectors.openapi.json
- Hosted MCP: https://fotofoto.app/mcp (Streamable HTTP, no session, no key)
- API catalog: https://fotofoto.app/.well-known/api-catalog

There is no `/.well-known/oauth-authorization-server` and no `/.well-known/oauth-protected-resource`, because no OAuth flow exists. Responses never carry `WWW-Authenticate: Bearer`.

## Pick a method

Only `anonymous` applies. `identity_assertion` and `service_auth` are not supported, and there is no `agent_auth` block to discover.

## Register

There is nothing to register. Call `get_catalog` over MCP, or `GET https://fotofoto.app/api/connector/catalog`, directly.

## Claim

`create_book` returns `bookId`, `bookToken`, `previewUrl` and `claimUrl`. The customer opens `claimUrl`, enters their email address and verifies the one-time code on foto foto. That saves the book to their account. The agent must never ask for the code, and an email address given to an agent proves nothing.

## Exchange

There is no token exchange. The `bookToken` is used as issued. It only grants access to that book, never to an account or to other books.

## Use the access token

- MCP: pass `bookToken` in the input of `get_book`, `create_checkout`, `create_payment_quote` and `pay_book`.
- HTTP: send the header `X-Fotofoto-Book-Token: <bookToken>` on `GET /api/connector/book`, `POST /api/connector/checkout`, `POST /api/connector/quotes` and `POST /api/connector/pay/{quoteId}`.
- Payment: `POST /api/connector/pay/{quoteId}` answers `402` with `WWW-Authenticate: Payment …` (Machine Payments Protocol) and an x402 body for USDC on Base. Retry with the same book header and either `Authorization: Payment …` or `X-PAYMENT: …`.

Keep `bookToken`, `claimUrl`, upload IDs and creation UUIDs private.

## Errors

Every error is JSON: `{"error": "<code>", "message": "<text>"}`, with `details` on validation errors.

- `400` invalid input
- `401` or `403` missing or wrong book token
- `404` unknown book
- `409` the same idempotency key with different inputs, or a payment already in progress
- `412` quote expired or book not claimed
- `413` photo or body too large
- `429` rate or daily quota exceeded, with `Retry-After`
- `503` uncertain outcome, retry with the same idempotency key

## Revocation

An unclaimed book, its photos and its token expire seven days after creation. After a claim the token expires 90 days later, and the customer keeps the book in the app. There is no revocation endpoint. Support: fotofoto@nternet.company.