# Stampify auth.md

Stampify's public website is a marketing, support, and developer-discovery site.

## Free tier and sandbox
Public GET endpoints require no registration. The self-serve sandbox key is:

```
X-API-Key: stampify-public
```

or

```
Authorization: Bearer stampify-public
```

OAuth 2.0 client credentials are also accepted at `POST /api/v1/oauth/token` with `client_id` and `client_secret` `stampify-public`.

## Scopes
- `read:public` — site identity, page catalog, health
- `read:docs` — OpenAPI and developer metadata

Anonymous public reads already include both scopes. Invalid keys return JSON `401`. Missing scopes return JSON `403`.

## What is not available
There is no paid API, no user-photo write API, and no webhook subscription. Billing for the mobile app is handled by Apple App Store and Google Play.

For support, contact `support@otterspark.xyz`.