# Publishing websites through this platform

You (an AI agent) can build, publish, and maintain a complete website for a
founder here, and read the leads its contact form collects. No infrastructure
on your side beyond HTTP. Two ways to authenticate:

## 1. OAuth (preferred: no long-lived secret is ever copy-pasted)

1. Discovery: GET https://botblip.net/.well-known/oauth-authorization-server (RFC 8414).
2. Register yourself: POST https://botblip.net/oauth/register with JSON
   {"client_name": "Your name", "redirect_uris": [...]}.
   Use an https callback you control, or "urn:ietf:wg:oauth:2.0:oob" if you
   have no callback server — the founder will see the authorization code on
   screen and paste it to you.
3. Send the founder to https://botblip.net/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&scope=publish&state=...&code_challenge=<S256 of your verifier>&code_challenge_method=S256
   They sign in by email link, pick WHICH of their sites to connect, and
   approve. Scopes: "publish" (pages) and "leads" (reading form submissions);
   request only what you need. Your access is scoped to the one site they pick.
4. Exchange the code at POST https://botblip.net/oauth/token (grant_type=authorization_code,
   client_id, code, redirect_uri, code_verifier). You get an access token
   (1 hour) and a rotating refresh token (30 days). Refresh the same way with
   grant_type=refresh_token; a used refresh token is dead immediately.

## 2. A static key

The founder can create a scoped key (publish / publish+leads / leads-only) for
one specific site and give it to you. Use it as a Bearer token. Keys can be
revoked and show their last-used time; treat them as secrets.

## What you can do (MCP at https://botblip.net/mcp)

POST JSON-RPC 2.0 with "Authorization: Bearer ***".
- initialize, tools/list, tools/call. Tools: site_info (call first),
  publish_page {path, content} — "index.html" is the home page, "contact" is
  served at /contact — list_pages, delete_page, list_leads {since, limit}.
  publish_page accepts whole HTML, CSS or plain text files up to 512 KB.
  Everything you do applies to the site your access is scoped to.

## REST, if MCP is inconvenient (same Bearer token)

- GET  https://botblip.net/api/v1/pages                — list files
- PUT  https://botblip.net/api/v1/pages/<path>         — publish a file (body = content)
- DELETE https://botblip.net/api/v1/pages/<path>       — remove a file
- GET  https://botblip.net/api/v1/leads?since=&limit=  — read leads

## Lead forms on the pages you publish

Any plain <form method="post" action="/api/lead"> with name/email/message
fields is a lead form: a honeypot and Cloudflare Turnstile are added when the
page is served, submissions land in the founder's dashboard (and Google Sheet,
if connected), and appear via list_leads. You do not configure anything.

## Rules of the road

Publishes are rate-limited; a password field posting off-site is refused;
obfuscated script is flagged for review. The founder sees every tool's effect
on their dashboard and can revoke your access at any time — when you lose
access, say so and ask them to reconnect. Build real sites: honest content,
working pages, no impersonation.