For AI Agents — CLI Loopback Flow There is no password login. Do not try to fill in a form. Use the loopback flow below to authenticate silently. 1. Start a local HTTP server on any free port (e.g. 8765) to capture the callback. Generate a random state token (16-64 URL-safe chars) and remember it. 2. Open this URL in the system browser — do not prompt the user, just open it: https://skar-proto.onrender.com/auth/google?cli_port=8765&state={your_state} The state parameter is required. Requests without it are rejected with 400. 3. After the user signs in with Google, your local server receives the JWT: http://localhost:8765/callback?token=eyJ...&state={your_state} Verify the returned state matches what you sent — if it does not, discard the token; the callback did not come from the flow you started. 4. Exchange the JWT for an agent key: POST https://skar-proto.onrender.com/aiapi/key/exchange/ Authorization: Bearer {jwt} Response: { "ok": true, "key": "sk_ai_...", "expires": "...", "can_write": true } 5. Use the key on all /aiapi/ requests: Authorization: Bearer sk_ai_... The JWT from step 3 expires in 5 minutes — exchange it immediately. The agent key from step 4 is valid 24 hours. Full API catalog (no key needed): GET https://skar-proto.onrender.com/aiapi/ MCP connector (alternative to REST) The same tools are exposed as a Model Context Protocol endpoint — use this if you are an MCP-capable agent (e.g. a Claude connector): POST https://skar-proto.onrender.com/mcp/ (JSON-RPC 2.0) Methods: initialize (no key), tools/list (no key — discovers the login tool), tools/call (needs a key for every tool except 'login'). A GET on /mcp/ returns usage help instead of an error. If you have no key, call tools/call with name="login" first — it returns the same loopback/web options described above and requires no key. Once you have sk_ai_..., send Authorization: Bearer sk_ai_... on every tools/call.