# Cozy Bee Studio auth.md

How software agents authenticate with Cozy Bee Studio (cozybeestudio.com).

## Audience

AI agents and other automated clients acting for a person who wants to browse or
buy a personalised children's book.

## You need no credentials for

Everything an agent needs to help someone shop is public and unauthenticated —
no API key, no registration:

- `GET https://cozybee-assets.s3.eu-west-1.amazonaws.com/data/products.json` — the catalogue
- `GET https://cozybee-assets.s3.eu-west-1.amazonaws.com/data/plans.json` — Book Club plans
- `POST https://sewo5uke3rdljcpp4osiduwpqm0hjfqm.lambda-url.eu-west-1.on.aws/personalization` — save a book's details
- `POST https://sewo5uke3rdljcpp4osiduwpqm0hjfqm.lambda-url.eu-west-1.on.aws/checkout` — returns a Stripe Checkout URL
- `GET https://sewo5uke3rdljcpp4osiduwpqm0hjfqm.lambda-url.eu-west-1.on.aws/health`

Full description: [OpenAPI](https://cozybeestudio.com/openapi.json) ·
[docs](https://cozybeestudio.com/developers/) ·
[API catalog](https://cozybeestudio.com/.well-known/api-catalog).

Payment is always completed by the person, on Stripe's page at the returned URL.
Agents never handle card details, and the price charged is Stripe's, not the request's.

## Agent registration

**Not offered.** We don't register agents or issue agent credentials, and there is no
OAuth authorization server for agents (so no `/.well-known/oauth-protected-resource`).

## Endpoints that need a signed-in person

Order history, the saved address, the AI character preview and subscription
management act on a customer's own data. They accept only a Firebase ID token
(`Authorization: Bearer <token>`) issued when **that person signs in themselves** with
Google or Apple at https://cozybeestudio.com/login/. An agent must not ask for, store
or reuse someone's token.

## Limits

Unauthenticated endpoints are rate-limited and may refuse bursts. Contact:
orders@cozybeestudio.com.