# auth.md

Iconsmith is an AI model for icons. Agents call `POST https://blode.co/iconsmith/api/v1/icons` with a bearer API key. There is no OAuth authorization-code login for the draw API.

## Audience

Coding agents and HTTP clients that need to draw icons. People using the playground sign in with email OTP at https://blode.co/iconsmith/sign-in and land on https://blode.co/iconsmith/account.

## Discovery

- Protected resource: https://blode.co/iconsmith/.well-known/oauth-protected-resource
- Authorization server: https://blode.co/iconsmith/.well-known/oauth-authorization-server
- This file: https://blode.co/iconsmith/auth.md

## Registration methods

### Anonymous API keys (supported)

1. Sandbox: send `Authorization: Bearer ism_test_` plus 32 base-62 characters. Any well-formed test key is accepted. Nothing is billed.
2. Browser draws: one free draw without sign-in. To draw more, sign in and add prepaid credits. Cookie-authenticated draws require the same origin.
3. Live API keys: send your `ism_live_` key as a bearer token. API draws spend prepaid credits.

Do not `POST /agent/auth`. That path is not implemented.

### Identity assertion (not supported)

ID-JAG and verified-email agent registration are not offered. `grant_types_supported` on the authorization server is empty. `https://blode.co/iconsmith/api/oauth/token` answers `unsupported_grant_type`.

## Using a credential

```
Authorization: Bearer ism_test_00000000000000000000000000000000
POST https://blode.co/iconsmith/api/v1/icons
Content-Type: application/json

{"concept":"bookmark-check","model":"iconsmith-1","n":2}
```

Scopes: `icons:draw`. Bearer method: HTTP header only.

## Docs

https://blode.co/iconsmith/docs