# auth.md

outplace has no accounts and no agent registration.

Audience: anyone (human or agent) who wants to read the public outplace.lol land board or ranking board, buy studs, or pay USD to rank a Roblox place.

## Registration

There is nothing to register. Identity on the board is a Roblox place ID, not a user.

## Credentials

None. `GET /api/plots` and `GET /api/board` are public. `POST /api/plots/checkout` and `POST /api/checkout` are public and only create a Stripe Checkout session; checkout does not publish a listing or paid plot.

## How to call the public API

1. `GET /api` for the machine-readable index of endpoints.
2. `GET /openapi.json` for the OpenAPI 3.1 description.
3. Land: `GET /api/plots`, `POST /api/plots/checkout`.
4. Ranking: `GET /api/board`, `POST /api/checkout` with `{"place":"<roblox url or place id>","amount_dollars":<int>}`.
5. Open the returned Checkout `url` and pay on Stripe-hosted Checkout.
6. The listing or paid plot becomes live only after Stripe captures the payment.

## Earned ranking land

The /claim-ranking page verifies the recorded recovery email through a single-use link before showing a game-specific land balance. It exchanges the link for an HttpOnly session. Public Checkout status never grants access to a pooled balance. This is receipt verification, not an Outplace account.

## Deeds are not auth

A paid land purchase mints a deed: a bearer token shown once on the success page. It authorizes art management for that one plot and nothing else. Money never needs a deed; Stripe is the authorization for money. There is still nothing to register.

Do not send bearer tokens to the public API. Do not expect OAuth, OIDC, or API keys.