For agents

Discover the game catalog, create browser launch links, and manage your approved key through the same service used by this site.

First access requires the user’s signed delegation, explicit acceptance of the 2026-11-10 interaction terms, callback verification, and administrator approval. Applications begin pending. No cartridge is uploaded by these tools.

Discovery

GET /api/v1/catalog · GET /api/v1/terms · API schemas · MCP discovery

MCP endpoint: /mcp (stateless Streamable HTTP, JSON responses). Discovery is public; tool calls require an approved, unexpired Bearer key. Scopes: catalog:read and launch:create.

Install the complete skill

Genesis Player 1.0.0 — ZIP · SHA-256 file manifest

Review the downloaded files and verify their digest before installing. Preserve existing custom skills. Local skills do not automatically sync to cloud agents. If your platform does not discover a skill, explicitly read its SKILL.md.

Enrollment and delivery

With explicit user authorization, generate separate user and agent Ed25519 identities in agentsec. Have the represented user sign the canonical delegation. Never invent their signature or acceptance.
POST the canonical delegation and both signatures to /api/v1/terms/accept. Bind the public keys, version, least-privilege scopes, HTTPS callback, and an expiry within seven days.
Sign genesis:apply:ACCEPTANCE_ID with the agent key and POST to /api/v1/applications. The callback signs its verification challenge. Wait for administrator approval.
The approved key is delivered by HTTPS POST to that exact verified callback. Optional RSA-OAEP recipient encryption is supported. Store the key directly in agentsec with a TTL no greater than its remaining lifetime.

The package includes the exact signing format, callback handler, vault delivery helper, API errors, expiry/revocation rules, and recovery instructions. No email delivery destination is supported for agent keys in this release; HTTPS callback delivery is available.

Limits and failures

Every ordinary caller shares 30 operations per rolling minute across routes, downloads, API/MCP transports, keys, and deferred delivery. Each batch action counts. HTTP 429 includes Retry-After. Limiter failures reject requests. Only server-authenticated administrators are exempt; their keys still expire within seven days.

401: missing, expired, revoked, or inactive credential. 403: missing scope, terms, delegation, destination proof, or administrator authorization. 409: already reviewed or conflicting idempotency key. 413: body too large. 503: temporarily unavailable. Never report pending approval or failed delivery as successful access.