# Musikeando — agent authentication

Cómo obtienen acceso los agentes a la API pública de Musikeando.

La mayor parte de la API es de solo lectura y no requiere credenciales. La creación de canciones funciona con una sesión de invitado anónima; la compra requiere una cuenta.

## Discover

- API catalog: https://musikeando.es/.well-known/api-catalog
- OpenAPI description: https://musikeando.es/openapi.json
- Protected resource metadata: https://musikeando.es/.well-known/oauth-protected-resource

## Pick a method

- `anonymous` — read-only catalog endpoints (`/api/pricing`, `/api/occasions`, `/api/health`).
- `guest session` — an anonymous cookie session, issued automatically on the first
  song-creation call. No registration required.
- `account session` — needed only to purchase and to access a customer library.

## Register

Create an account through the public form, or programmatically via `POST https://musikeando.es/api/auth/register`.

## Claim and exchange

Musikeando does not currently operate an OAuth 2.0 authorization server, so there is
no `identity_assertion` or `service_auth` exchange. Discovery documents that would
describe one are intentionally not published until the endpoints exist.

## Use the access token

Authenticated calls use the session cookie set by the sign-in flow. Send cookies with
the request (`credentials: "include"`). Endpoints that require a session answer `401`
with `WWW-Authenticate: Bearer resource_metadata="https://musikeando.es/.well-known/oauth-protected-resource"`.

## Errors

Errors are JSON: `{ "error": "<message>", "details": <optional> }`.

## Revocation

Sign out invalidates the session cookie. Report abuse at https://musikeando.es/reportar-abuso.