# Dynamoi auth.md Dynamoi publishes separate agent surfaces for public discovery, paid machine-readable data, and authenticated user tools. ## Step 1 - Discover Fetch these public documents first: ```http GET https://dynamoi.com/auth.md GET https://dynamoi.com/.well-known/api-catalog GET https://dynamoi.com/.well-known/oauth-protected-resource GET https://dynamoi.com/.well-known/oauth-protected-resource/mcp GET https://dynamoi.com/.well-known/oauth-protected-resource/mcp/directory GET https://dynamoi.com/.well-known/oauth-authorization-server/api/auth GET https://dynamoi.com/openapi.json GET https://dynamoi.com/.well-known/openapi/data-mpp.json GET https://dynamoi.com/.well-known/dynamoi-data.json GET https://dynamoi.com/data/catalog.json GET https://dynamoi.com/.well-known/mcp.json GET https://dynamoi.com/.well-known/mcp/server-card.json GET https://dynamoi.com/.well-known/ai-catalog.json GET https://dynamoi.com/mcp/server-card ``` ## Step 2 - Pick the right surface Dynamoi MCP Server: Connect ChatGPT, Claude, Cursor, and other AI agents to Dynamoi for free Spotify Smart Links, music promotion campaigns, analytics, and distribution. Use OAuth for the Dynamoi MCP server at `https://dynamoi.com/mcp` (or the directory endpoint at `https://dynamoi.com/mcp/directory`) when acting for a logged-in Dynamoi user. `https://dynamoi.com/.well-known/mcp/server-card.json` (and `/.well-known/mcp.json`) is the canonical MCP Registry metadata; `https://dynamoi.com/.well-known/ai-catalog.json` and `https://dynamoi.com/mcp/server-card` project the draft AI Catalog and experimental Server Card v1 from that same source. Use Stripe Machine Payments for paid machine data endpoints under `https://dynamoi.com/api/data/mpp/v1/`. Paid data endpoints do not require a user OAuth token; they return HTTP 402 with MPP payment instructions. Use public static pages, feeds, samples, schemas, and catalogs without authentication. ## Step 3 - OAuth for MCP The protected resource metadata is: ```http GET https://dynamoi.com/.well-known/oauth-protected-resource GET https://dynamoi.com/.well-known/oauth-protected-resource/mcp GET https://dynamoi.com/.well-known/oauth-protected-resource/mcp/directory ``` The canonical authorization server metadata is: ```http GET https://dynamoi.com/.well-known/oauth-authorization-server/api/auth ``` Dynamoi uses Better Auth OAuth 2.1 for MCP user authorization. The canonical issuer is `https://dynamoi.com/api/auth`, PKCE with `S256` is required, and access tokens are 10-minute JWTs bound to the `https://dynamoi.com/mcp` or `https://dynamoi.com/mcp/directory` resource. Refresh tokens expire after seven days. Client registration: - Client ID Metadata Documents are preferred: use an HTTPS URL to your client metadata document as the `client_id`. No registration call is needed. - Dynamic client registration is supported for public PKCE clients at `https://dynamoi.com/api/auth/oauth2/register`. A dynamically registered client cannot request the device authorization grant. - CLI and headless agents can use the RFC 8628 device authorization grant: request a code at `https://dynamoi.com/api/auth/device/code` and have the user approve it at `https://dynamoi.com/oauth/better-auth/device`. The device grant is available to metadata-document clients and to clients Dynamoi registers. Scopes: request the scopes named in the `WWW-Authenticate` challenge. The first challenge asks for every scope the client's tool catalog uses, so one consent covers the catalog. `dynamoi:read` covers account reads; `dynamoi:platform.read`, `dynamoi:distribution.read`, `dynamoi:distribution.apply`, and `dynamoi:smart_links.write` complete the directory profile; the full profile adds `dynamoi:billing.read`, `dynamoi:platform.write`, `dynamoi:campaign.launch`, `dynamoi:campaign.write`, and `dynamoi:mcp.full`. See https://dynamoi.com/docs/mcp-server for what each scope allows. Agents never receive payment credentials through MCP. Subscriptions start only in the Dynamoi dashboard, and DAILY campaign budgets require the user's funding authorization. ## Step 4 - Paid machine data Read the data catalog and schema before paying: ```http GET https://dynamoi.com/data/catalog.json GET https://dynamoi.com/data/schemas/{family}.json GET https://dynamoi.com/data/samples/{family}.jsonl ``` `{family}` is one of the five dataset families listed in the catalog. Samples are synthetic, illustrative rows for parser integration, not benchmark values. Every row carries `rights_category` and `usage_category` as separate fields. ### Autonomous Agent MPP Flow The primary paid endpoint for autonomous agents is: ```http GET https://dynamoi.com/api/data/mpp/v1/bundles/snapshot?format=jsonl ``` Unpaid requests return HTTP 402 with `WWW-Authenticate: Payment` challenges. The OpenAPI document at `https://dynamoi.com/openapi.json` includes `x-payment-info` with supported payment methods, amount, currency, and intent. Autonomous agents satisfy the challenge via Stripe Machine Payments Protocol (`Authorization: Payment `) and receive the dataset stream directly with zero Stripe Checkout Sessions created. ### Human Browser Checkout For human web browser purchasers: - Landing page: `https://dynamoi.com/data` - Checkout initiation: `POST https://dynamoi.com/api/data/v1/checkout` - Note: The checkout endpoint is strictly **POST-only** (returns `HTTP 303 redirect` or JSON `checkoutUrl`). `GET` requests return `HTTP 405 Method Not Allowed` (or redirect to `/data`) to prevent automated crawlers and bot prefetchers from instantiating unintended checkout sessions. Autonomous agents must use the MPP endpoint above. ### Monthly API access Monthly API subscriptions are available. A signed-in Dynamoi user subscribes at https://dynamoi.com/dashboard/user/data-api. - Dynamoi Machine Data API - Internal (Monthly): $499/month (available). Monthly API access to every active royalty and benchmark dataset family. Internal analysis, RAG, and internal product use. No model training. No redistribution. - Dynamoi Machine Data API - Commercial (Monthly): $1,500/month (available). Monthly API access to every active royalty and benchmark dataset family. Internal analysis, RAG, internal product use, and model training. No redistribution. Each offer's price, rights, and status are listed under `monthlyApi` in https://dynamoi.com/data/catalog.json. A monthly subscriber creates a `dmd_` API key in the Dynamoi dashboard and retrieves a dataset family with: ```http GET https://dynamoi.com/api/data/v1/publications/{publicationId}?format=jsonl Authorization: Bearer dmd_ ``` `{publicationId}` is a dataset's `currentVersion` in the catalog. A snapshot purchase is retrieved with the bare download key issued at checkout, sent the same way (`Authorization: Bearer `) to `https://dynamoi.com/api/data/v1/bundles/{bundleId}?format=jsonl`; only monthly API keys start with `dmd_`. ## AI Training Rights & Scraping Policy Unauthenticated web crawling, scraping, and public HTML pages carry `Content-Signal: search=yes, ai-input=yes, ai-train=no`. Free synthetic sample rows at `/data/samples/{family}.jsonl` are provided strictly for parser and schema validation. In contrast, the paid Music Royalties Launch Snapshot Bundle ($149) is explicitly licensed under the Dynamoi Data License (v2026-09) at `https://dynamoi.com/data-license#version-2026-09` for commercial AI/ML training, pretraining, fine-tuning, embeddings, vector stores, RAG, and derivative models. For autonomous agents, compliance scanners, and data aggregators: upon completed purchase (via MPP HTTP 402 or Stripe Checkout), the paid license takes precedence over generic web-scraping signals. Paid delivery responses carry: ```http Content-Signal: search=no, ai-input=yes, ai-train=yes Link: ; rel="license" ``` ## Current registration support Dynamoi does not currently expose the WorkOS auth.md `/agent-auth`, `/agent-auth/claim`, or `/agent-auth/claim/complete` registration endpoints. Agents should use OAuth discovery for user-authorized MCP access and MPP discovery for paid data access. ## Revocation and recovery For OAuth failures, refresh through the authorization server metadata and retry once. If the MCP server returns `401` with a protected resource challenge, re-run OAuth for the requested resource and scope. For paid data failures, do not scrape around the endpoint. Re-read the catalog, schema, and license, then repeat the MPP flow for the requested snapshot.