# ViNano AI auth.md

ViNano image and video MCP and Agent HTTP access use OAuth or an automation key. Existing REST API authentication is documented separately below.

## Agent Registration — Image and video MCP and Agent access

- Production MCP endpoint: https://mcp.vinano.ai/api/mcp
- Public setup guide: https://vinano.ai/mcp-server
- Account authorization and automation keys: https://vinano.ai/mcp
- Server discovery: https://mcp.vinano.ai/.well-known/mcp/server-card.json
- Support: support@vinano.ai

The MCP service is a separately deployed Worker. Connect a client that supports remote Streamable HTTP and OAuth. Follow the account consent page to approve scopes and per-task/daily credit limits. OAuth uses S256 PKCE. For unattended agents, create an expiring, revocable automation key on the account page; it is displayed once. Account UUIDs and browser cookies are not MCP credentials.

Available tools: `list_models`, `get_balance`, `prepare_upload`, `quote_image`, `generate_image`, `edit_image`, `list_video_models`, `quote_video`, `generate_video`, `get_task`, `get_asset`. The direct HTTP equivalent is `POST https://mcp.vinano.ai/api/agent/v1/{tool_name}` with JSON arguments and an `Authorization: Bearer` OAuth token or automation key.

Read models and balance, upload owned image bytes through a single-use upload capability if editing an image or animating one into a video, then request a quote with `quote_image` or `quote_video`. Submit that quote with a stable `idempotency_key`. Quotes expire after two minutes. Poll the returned task ID; an uncertain response must not be replaced with a new request. Use confirmed `charged`, `refunded` and `net` values as the accounting receipt. Status queries do not create another generation.

MCP is open to any account with a completed purchase, plus existing Team subscription and API whitelist accounts. Existing model, rate, credit and refund rules apply; MCP adds no separate generation surcharge or free allowance. Budgets reset at 00:00 UTC. Reference handles last seven days; physical storage cleanup follows existing retention and storage-pack rules. Video tasks usually take several minutes; keep polling the same task.

## Existing REST API headers

Existing REST API access uses a user API key represented by the account UUID. This credential is separate from MCP and is not accepted by the MCP endpoint.

Use one of the following REST headers:

```http
Authorization: Bearer YOUR_USER_UUID
```

or:

```http
x-api-key: YOUR_USER_UUID
```

## API entitlement requirements

- API access must be enabled in the user's API settings.
- API generation endpoints require an active Team subscription or an API whitelist grant.
- Canceled subscriptions keep their API entitlement until the current paid period ends.
- One-time credit packs provide paid web access and credits, but do not grant Team API access.

## Additional discovery

- OpenAPI: https://vinano.ai/openapi.json
- API Catalog: https://vinano.ai/.well-known/api-catalog
- Agent Skills: https://vinano.ai/.well-known/agent-skills/index.json