# saascode access and authentication

## Public catalog and documents

GET https://saascode.ai/api/catalog and GET https://saascode.ai/api/catalog/{slug} require no account, API key or subscription. Resolve a visible product slug with the list endpoint. The [OpenAPI specification](https://saascode.ai/openapi.json) describes this read-only surface. Public Markdown documents and the public Genesis website can also be read without a member key.

## Genesis MCP for members

Genesis MCP is a separate member service at https://saascode.ai/api/genesis/mcp. It accepts JSON-RPC requests over HTTP POST with Content-Type: application/json and Authorization: Bearer <YOUR_GENESIS_MEMBER_KEY>. Use a key belonging to your own SaaSCode member account. An active membership is checked on every request, independently of whether the key was previously valid.

The key is a personal credential. Keep it in your client's secret storage, send it only to this Genesis endpoint, and never put it in a URL, a public repository, a chat transcript or a shared document. A catalog API key is unnecessary and an organization/admin key is not a Genesis member key.

## Obtain or revoke a key

Use [Plus](https://saascode.ai/plus) for membership information. If you do not have a provisioned Genesis key, contact [support](https://saascode.ai/support) from the email on your member account. This guide does not advertise a self-service key creation or revocation endpoint: one is not exposed by the current storefront. Ask support to revoke a lost or compromised key without sending the key itself. A revoked key is rejected; a lapsed membership also loses MCP access. Products you already purchased retain their existing licences.

## Connect and use

Configure your MCP client with the Genesis endpoint and the Authorization header. Use a client that supports this HTTP JSON-RPC service and configurable Bearer headers. Initialize the connection, discover the tools with tools/list and send tools/call requests using their advertised schemas. Available scopes and brief budgets belong to the member service; a public catalog lookup does not unlock them. No private member content is included in the public catalog API or these documents.

## Errors

- HTTP 401: the member key is missing, invalid or revoked. Check the Authorization header, then contact support if needed.
- HTTP 403: the key belongs to an account without an active eligible membership. Review membership in your account.
- HTTP 400: the request body is not valid JSON. Send the JSON-RPC envelope expected by the endpoint.
- JSON-RPC errors: inspect the error code and message. Tool arguments must match the schema returned by tools/list.
- HTTP 429: respect Retry-After when present and retry with backoff.

## Account actions and checkout

Account pages use your signed-in session. Downloads, tickets, membership changes and purchases keep their existing ownership and access checks. An agent can help you find and compare products; review and confirm a purchase yourself on the website. The public API is not a payment or account-management API.

This is a factual guide to the current credential flow. It does not advertise an OAuth authorization server, OAuth token exchange or WorkOS auth.md agent-registration protocol.

- [API documentation](https://saascode.ai/developers.md)
- [Support](mailto:support@saascode.ai)
- [Terms](https://saascode.ai/terms.md)
- [Privacy](https://saascode.ai/privacy.md)