# Auth.md — Editable QR Code

## User account

Ask the user to [sign up](https://www.editableqrcode.com/signup) or [sign in](https://www.editableqrcode.com/login) in their browser.
An account is required to save or download a QR code. Signup starts a seven-day Business trial without a payment card.
Users can create and download during the trial before email verification, but must verify their email within seven days to retain access.
The user must complete verification, accept terms, and approve any subscription themselves.

## REST API

Base URL: https://www.editableqrcode.com/api/v1
This API uses account-scoped API keys, not an OAuth authorization server. It does not support autonomous agent registration or OAuth token exchange.

1. The user opens [Dashboard → API keys](https://www.editableqrcode.com/dashboard/api-keys).
2. The user creates a read-only key for inspection, or a read+write key for authorized changes. The plaintext key is shown once; store it securely.
3. Send the key in the HTTP header: Authorization: Bearer <key>
4. Never put keys in URLs, public files, source code, or chat transcripts. The user can revoke a key in the dashboard.

GET requests require read scope. Mutations require write scope and account access; inactive accounts cannot write.
Trial and Business API limits are 600 requests/minute; Pro is 60. Limits are shared across the owner's keys. Respect Retry-After on HTTP 429.
HTTP 401 means missing, invalid, revoked credentials or lost verification access. HTTP 403 means insufficient scope or account restrictions.
Do not retry authentication failures indefinitely. Ask the user to restore access.

[API documentation](https://www.editableqrcode.com/docs) · [OpenAPI description](https://www.editableqrcode.com/docs/openapi.json)

## Public MCP tools

Connect via Streamable HTTP to https://www.editableqrcode.com/api/mcp. No authentication is required for list_qr_products or get_qr_product.
These tools return public product guides only. They do not accept API keys, access user accounts, save codes, or make purchases.
Use a server-side MCP client; browser requests are restricted to this application's origins. See the [server card](https://www.editableqrcode.com/api/mcp/server-card).

## Agent boundaries

Public product lookup tools are read-only. They do not create accounts, save QR codes, expose private QR content, or purchase plans.
Use only credentials explicitly authorized by the account owner. Confirm destinations and content before creating or changing a QR code; confirm destructive actions and purchases with the user.
Static QR payloads cannot be edited after printing and do not have scan analytics. A new payload requires a new code.