> Documentation index: [/llms.txt](https://www.outfame.com/llms.txt)

For AI Agents

# Account access for agents

With the user's approval, an agent can read that user's Outfame account: their email, every connected Instagram or TikTok account with its status and follower numbers, and each account's plan and plan status. Access is read-only (scope `account:read`). It never includes prices, payment details or card data, and nothing can be changed.

| Interface | Address | What it does |
| --- | --- | --- |
| **Account API** | `GET https://www.outfame.com/api/agents/v1/me` | The account summary as JSON. |
| **Account MCP server** | `https://www.outfame.com/mcp/account` | Tools `get_account_summary`, `list_connected_accounts` and `get_growth_stats` (daily follower numbers for up to 90 days). |

## Account MCP tools

| Tool | What it returns | Arguments |
| --- | --- | --- |
| `get_account_summary` | The user's Outfame account: email, every connected Instagram or TikTok account with its status and follower numbers, and each account's plan and plan status. | None |
| `list_connected_accounts` | The user's connected social accounts with id, platform, username, connection status, whether growth is running, follower numbers and plan. | None |
| `get_growth_stats` | Daily follower readings for one connected account over the last 1 to 90 days (default 30), with the change over the period and since the account joined Outfame. | account_id or username (optional when the user has a single account); days (whole number, 1 to 90, optional) |

Without a token each answers status 401 and points at the metadata of its own resource:

```
GET /api/agents/v1/me
WWW-Authenticate: Bearer resource_metadata="https://www.outfame.com/.well-known/oauth-protected-resource", scope="account:read"

POST /mcp/account
WWW-Authenticate: Bearer resource_metadata="https://www.outfame.com/.well-known/oauth-protected-resource/mcp/account", scope="account:read"
```

An access token is bound to the resource it was issued for (`https://www.outfame.com` or `https://www.outfame.com/mcp/account`; both when the client names none). There are two ways to get a token.

## OAuth 2.1 (MCP clients and apps)

Outfame is its own authorization server (issuer `https://www.outfame.com`). Clients register themselves, then use the authorization code flow with PKCE (S256). The user logs in to Outfame and approves on a consent screen that names the app and says exactly what it can read.

| Step | Endpoint |
| --- | --- |
| Metadata | `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource` |
| Register the client | `POST /api/oauth/register` (public clients; redirect URIs on https, http loopback on any port, or a native app scheme such as `com.example.app:/callback`) |
| User approves | `/oauth/authorize` |
| Tokens | `POST /api/oauth/token`: a one-hour access token and a refresh token that changes on every use; a grant lasts at most 90 days |
| Revoke | `POST /api/oauth/revoke` |

MCP clients that support OAuth do all of this on their own. In Claude Code:

```
claude mcp add --transport http outfame-account https://www.outfame.com/mcp/account
```

## Agent registration (auth.md)

An agent without a browser registers itself at `POST /api/agent-auth/register` and gets a key at once. The key works for public data; account data needs the user to approve it once by opening the claim link the agent gets from `POST /api/agent-auth/claim`. The step-by-step guide for agents is `https://www.outfame.com/auth.md`.

Users see every app and agent they approved under Settings, Security, Connected AI agents, and can revoke any of them there.

## Pages in this section

- [AI agents and developer access](https://www.outfame.com/docs/agents.md): what the agent interfaces are and where each one lives.
- [MCP server](https://www.outfame.com/docs/agents/mcp-server.md): the public MCP server at /mcp: protocol versions, the five tools and their inputs, client setup and errors.
- [A2A agent](https://www.outfame.com/docs/agents/a2a-agent.md): the A2A endpoint at /a2a: both message methods, the five skills with example questions, the reply format and errors.
- [REST API for agents](https://www.outfame.com/docs/agents/rest-api.md): the read-only JSON endpoints under /api/agents/v1, their parameters, response fields and the OpenAPI file.
- [Discovery files](https://www.outfame.com/docs/agents/discovery-files.md): the llms.txt, robots.txt and /.well-known files that let agents find these interfaces.