--- title: "Access and permissions | StudioMeyer Academy" description: "Read publicly or connect personal learning data. You choose the permissions." canonical: "https://studiomeyer.academy/en/entwickler/anmeldung" language: en markdown_versions: ["https://studiomeyer.academy/entwickler/anmeldung.md", "https://studiomeyer.academy/en/entwickler/anmeldung.md", "https://studiomeyer.academy/es/entwickler/anmeldung.md"] publisher: "StudioMeyer Academy, https://studiomeyer.academy (llms.txt: https://studiomeyer.academy/llms.txt)" --- ## Discover Read the protected-resource metadata for your entry. A protected MCP 401 identifies it in WWW-Authenticate. The shared issuer is https://mcp.studiomeyer.academy. REST and MCP are separate resources: https://studiomeyer.academy/v1 and https://mcp.studiomeyer.academy/mcp. An OAuth token is bound to the selected resource; do not reuse it for the other. - [REST resource metadata](https://studiomeyer.academy/.well-known/oauth-protected-resource) - [OAuth authorization server](https://mcp.studiomeyer.academy/.well-known/oauth-authorization-server) ## Choose a method Learning paths, lessons, library, search and suggestions work without an account. A supplied agent profile is used only for the current suggestion request and is not stored by that request. Send only what is needed. OAuth connects an AI tool to your personal features. An API key is for your own scripts. Share neither browser cookies nor login credentials with an AI. ## Register a client Your OAuth client registers its actual redirect\_uris with POST /register at the issuer. Public clients use token\_endpoint\_auth\_method: none. Use the returned client\_id. Generate a fresh state and secret code\_verifier for each sign-in, then derive the PKCE S256 code\_challenge. Do not register an invented callback URL. ## Approve permissions yourself Open /authorize with response\_type=code, client\_id, redirect\_uri, state, code\_challenge, code\_challenge\_method=S256, scope and resource. The person signs in in the browser and chooses permissions. credits:spend is off by default. Existing connections never receive new scopes automatically. Permission Allows learn:read Read personal learning data and credit balance learn:write Write progress, notes, feedback and installation plans credits:spend OAuth only: individually approved credit actions, never by scope alone ## Exchange the code Verify state on return. Exchange the code at POST /token using grant\_type=authorization\_code, code, client\_id, the exact same redirect\_uri, code\_verifier and resource. Use application/x-www-form-urlencoded. A public client needs no client secret. Refresh with grant\_type=refresh\_token and replace the old refresh token with the rotated one. Reuse revokes the token family. ## Use the credential Send Authorization: Bearer \ only to the selected resource. GET /v1/me/access or academy\_my\_access shows the permissions actually granted. Cookies cannot replace REST bearer authentication. Store tokens securely and never write them into URLs, logs or repositories. ``` # Set ACADEMY_TOKEN locally to your REST credential. Never commit it. curl -fsS 'https://studiomeyer.academy/v1/me/access' \ -H "Authorization: Bearer $ACADEMY_TOKEN" ``` ## API keys Create and revoke personal keys yourself in the browser session at /dashboard/keys. read maps to learn:read; read-write maps to learn:read and learn:write. Keys cannot spend credits. OAuth grants and existing keys cannot create more keys. - [Manage API keys](https://studiomeyer.academy/en/dashboard/keys) ## Request limits The table shows current REST buckets. Public requests share a conservative bucket by default. Only an explicitly configured IP header replaced by a trusted proxy separates anonymous clients. MCP and OAuth may add transport limits. Responses include RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; reset and Retry-After are seconds. Bucket Limit Window (s) Identity anonymous 120 60 shared\_anonymous read 120 60 verified\_principal write 30 60 verified\_principal ## Handle errors REST and MCP return success, result, errors, messages and request\_id. Branch on errors\[\].slug or code, never on translated text. OAuth endpoints instead use OAuth error and error\_description. A missing scope requires the person to authorize a new connection with the needed permissions. - [Understand errors](https://studiomeyer.academy/en/entwickler/fehler) ## Revoke access Send token, client\_id and optionally token\_type\_hint as a form to POST /revoke at the issuer. Revoke an API key in the dashboard. Expired or revoked credentials cannot perform protected calls. Reconnect only when the person requests it. ## Safe workflow Read first, suggest next and write only within the requested scope. Deletion requires confirm: true after approval. Show packages, files and scripts before writing. Follow returned links, inspect responses and stop on an unknown outcome. Resolve outcome\_unknown using the ledger first, never with a new payment attempt. ## Spend credits Purchases and spending remain disabled (unconfigured) without approved prices, credit amounts and legal configuration. No test payment creates real credit. An OAuth scope alone is never permission to spend credits. GET /v1/premium/{id}/preview only reads the preview and returns quote: null, including when authenticated. Create a specific quote using POST /v1/me/spend-quotes or academy\_prepare\_spend. The agent needs an explicit OAuth grant with learn:write and credits:spend plus Idempotency-Key. Preparation has creditEffect: none; it creates a pending quote and does not accept userConfirmed. Send exactly one input variant: { purpose: PREMIUM, id }, { purpose: TUTOR, level, slug, message } or { purpose: COACHING, topic, format, preferredTime? }. The server determines price, credit amount and versions. The quote binds the same inputs to the account owner and OAuth grant, content, version and expiry. The person separately approves the specific quote at /dashboard/agent in a verified browser session; only persisted approval counts. Then the actual spending request carries consent: { userConfirmed: true, quoteId, maximumCredits } and its own Idempotency-Key. An agent-supplied true cannot replace browser approval. Personal API keys and browser sessions cannot perform agent spending. Coaching must never use bonus credits. ## Agent registration (agent\_auth) The authorization server supports anonymous agent registration with human takeover. POST /agent/identity with type=anonymous starts with no personal scopes. POST /agent/identity/claim prepares email verification, the same browser and the agent's code. The person explicitly selects learn:read and learn:write; credits:spend is unavailable there. After takeover, Academy links the verified address to an existing account or creates one on the first personal request. The agent then polls /token using the claim grant. Ordinary OAuth and separate browser approval remain required for later spending. No external identity issuers or security-event endpoints are advertised. - [identity\_endpoint (POST)](https://mcp.studiomeyer.academy/agent/identity) - [claim\_endpoint (POST)](https://mcp.studiomeyer.academy/agent/identity/claim) - [Authorization metadata](https://mcp.studiomeyer.academy/.well-known/oauth-authorization-server) ## Sitemap Public pages of this site as Markdown: [sitemap](https://studiomeyer.academy/sitemap.md). Curated entry point: [llms.txt](https://studiomeyer.academy/llms.txt), full text: [llms-full.txt](https://studiomeyer.academy/llms-full.txt).