Agent-ready API surface

Peptide Tracker API Docs

Public discovery metadata for session auth, widget access, and health checks. This app uses anonymous access codes with secure browser cookies today.

Machine-readable
OpenAPI Spec
RFC 9727
API Catalog
Agent Skills
Skills Index

Session auth

Anonymous access codes create secure browser sessions with HttpOnly JWT cookies.

POST /auth/signup

Create an anonymous account and set session cookies.

POST /auth/login

Exchange an access code for session cookies.

POST /auth/logout

Clear session cookies.

POST /auth/refresh

Refresh the access cookie from the refresh cookie.

GET /auth/me

Return the current authenticated user.

Widget and health

The public widget flow uses short-lived widget tokens; readiness probes stay public.

POST /dashboard/api/widget/token

Mint a one-hour widget token from an access code.

GET /dashboard/api/widget

Read widget data with Authorization: Bearer or X-Widget-Token.

GET /health

Plain-text health check.

GET /readyz

Database-backed readiness status.

Discovery endpoints

Machine-readable metadata for agents and API clients.

GET /.well-known/api-catalog

RFC 9727 API catalog in application/linkset+json.

GET /.well-known/openapi.json

OpenAPI 3.1 service description covering public and agent-relevant endpoints.

GET /.well-known/agent-skills/index.json

Agent Skills discovery index with digests for each published SKILL.md artifact.

GET /.well-known/llms.txt

High-level model-facing project summary.

Protocol notes

This site does not publish OAuth/OIDC discovery metadata or an MCP server card yet.

INFO https://tracker.unclelyh.me/auth

Authentication is access-code plus cookie based today, not OAuth 2.0 or OpenID Connect.

INFO https://tracker.unclelyh.me

Browser-side WebMCP tools are exposed on public pages; there is no standalone MCP server transport yet.