For AI Agents
Account access for agents
With the user's approval, an agent can read that user's Outfame account: their email, every connected Instagram or TikTok account with its status and follower numbers, and each account's plan and plan status. Access is read-only (scope account:read). It never includes prices, payment details or card data, and nothing can be changed.
| Interface | Address | What it does |
|---|---|---|
| Account API | GET https://www.outfame.com/api/agents/v1/me | The account summary as JSON. |
| Account MCP server | https://www.outfame.com/mcp/account | Tools get_account_summary, list_connected_accounts and get_growth_stats (daily follower numbers for up to 90 days). |
Account MCP tools
| Tool | What it returns | Arguments |
|---|---|---|
get_account_summary | The user's Outfame account: email, every connected Instagram or TikTok account with its status and follower numbers, and each account's plan and plan status. | None |
list_connected_accounts | The user's connected social accounts with id, platform, username, connection status, whether growth is running, follower numbers and plan. | None |
get_growth_stats | Daily follower readings for one connected account over the last 1 to 90 days (default 30), with the change over the period and since the account joined Outfame. | account_id or username (optional when the user has a single account); days (whole number, 1 to 90, optional) |
Without a token each answers status 401 and points at the metadata of its own resource:
GET /api/agents/v1/me
WWW-Authenticate: Bearer resource_metadata="https://www.outfame.com/.well-known/oauth-protected-resource", scope="account:read"
POST /mcp/account
WWW-Authenticate: Bearer resource_metadata="https://www.outfame.com/.well-known/oauth-protected-resource/mcp/account", scope="account:read"An access token is bound to the resource it was issued for (https://www.outfame.com or https://www.outfame.com/mcp/account; both when the client names none). There are two ways to get a token.
OAuth 2.1 (MCP clients and apps)
Outfame is its own authorization server (issuer https://www.outfame.com). Clients register themselves, then use the authorization code flow with PKCE (S256). The user logs in to Outfame and approves on a consent screen that names the app and says exactly what it can read.
| Step | Endpoint |
|---|---|
| Metadata | /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource |
| Register the client | POST /api/oauth/register (public clients; redirect URIs on https, http loopback on any port, or a native app scheme such as com.example.app:/callback) |
| User approves | /oauth/authorize |
| Tokens | POST /api/oauth/token: a one-hour access token and a refresh token that changes on every use; a grant lasts at most 90 days |
| Revoke | POST /api/oauth/revoke |
MCP clients that support OAuth do all of this on their own. In Claude Code:
claude mcp add --transport http outfame-account https://www.outfame.com/mcp/accountAgent registration (auth.md)
An agent without a browser registers itself at POST /api/agent-auth/register and gets a key at once. The key works for public data; account data needs the user to approve it once by opening the claim link the agent gets from POST /api/agent-auth/claim. The step-by-step guide for agents is https://www.outfame.com/auth.md.
Users see every app and agent they approved under Settings, Security, Connected AI agents, and can revoke any of them there.
Pages in this section
- AI agents and developer access: what the agent interfaces are and where each one lives.
- MCP server: the public MCP server at /mcp: protocol versions, the five tools and their inputs, client setup and errors.
- A2A agent: the A2A endpoint at /a2a: both message methods, the five skills with example questions, the reply format and errors.
- REST API for agents: the read-only JSON endpoints under /api/agents/v1, their parameters, response fields and the OpenAPI file.
- Discovery files: the llms.txt, robots.txt and /.well-known files that let agents find these interfaces.