Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: Scribiz Auth API
version: 1.0.0
description: 'Operations tagged Auth across 2 of this provider''s published API definitions: openapi.json, scribiz-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- description: 'The one public base for every client: https://scribiz.com/api (Better Auth at /api/auth, remote MCP at https://scribiz.com/mcp). The proxy routes both paths to this API.'
url: https://scribiz.com/api
tags:
- name: Auth
paths:
/auth/device/code:
post:
description: RFC 8628 device authorization. `client_id` is scribiz-cli, scribiz-mac or scribiz-mcp.
operationId: deviceCode
requestBody:
content:
application/json:
schema:
properties:
client_id:
type: string
required:
- client_id
type: object
description: JSON
responses:
'200':
content:
application/json:
schema:
type: object
description: Device and user codes.
summary: Start a device login
tags:
- Auth
servers:
- description: 'The one public base for every client: https://scribiz.com/api (Better Auth at /api/auth, remote MCP at https://scribiz.com/mcp). The proxy routes both paths to this API.'
url: https://scribiz.com/api
/auth/device/token:
post:
operationId: deviceToken
requestBody:
content:
application/json:
schema:
properties:
client_id:
type: string
device_code:
type: string
grant_type:
const: urn:ietf:params:oauth:grant-type:device_code
required:
- grant_type
- device_code
- client_id
type: object
description: JSON
responses:
'200':
content:
application/json:
schema:
type: object
description: A session token.
'400':
description: authorization_pending, slow_down, expired_token, access_denied
summary: Poll for the device login result
tags:
- Auth
servers:
- description: 'The one public base for every client: https://scribiz.com/api (Better Auth at /api/auth, remote MCP at https://scribiz.com/mcp). The proxy routes both paths to this API.'
url: https://scribiz.com/api
/auth/sign-in/magic-link:
post:
operationId: magicLink
requestBody:
content:
application/json:
schema:
properties:
callbackURL:
type: string
email:
format: email
type: string
required:
- email
type: object
description: JSON
responses:
'200':
content:
application/json:
schema:
type: object
description: Sent.
summary: Email a sign-in link
tags:
- Auth
servers:
- description: 'The one public base for every client: https://scribiz.com/api (Better Auth at /api/auth, remote MCP at https://scribiz.com/mcp). The proxy routes both paths to this API.'
url: https://scribiz.com/api
components:
securitySchemes:
apiKey:
description: 'An API key (sbz_live_...), as X-API-Key. Keys are made in the dashboard or by `scribiz login`. Each key has one scope, named in an operation''s security requirement. `all`: Everything a key can do: start jobs, upload, ask, cancel, the Gemini proxy and listing keys. Includes read. `mcp`: The remote MCP server at /mcp. Includes read. `read`: Read jobs and their events.'
in: header
name: X-API-Key
type: apiKey
x-scopes:
all: 'Everything a key can do: start jobs, upload, ask, cancel, the Gemini proxy and listing keys. Includes read.'
mcp: The remote MCP server at /mcp. Includes read.
read: Read jobs and their events.
bearer:
description: 'An API key (sbz_live_...) or a session token from the device flow. Each key has one scope, named in an operation''s security requirement. `all`: Everything a key can do: start jobs, upload, ask, cancel, the Gemini proxy and listing keys. Includes read. `mcp`: The remote MCP server at /mcp. Includes read. `read`: Read jobs and their events. A session token has every scope.'
scheme: bearer
type: http
x-scopes:
all: 'Everything a key can do: start jobs, upload, ask, cancel, the Gemini proxy and listing keys. Includes read.'
mcp: The remote MCP server at /mcp. Includes read.
read: Read jobs and their events.
cookie:
description: The browser session (same-origin /api/*).
in: cookie
name: better-auth.session_token
type: apiKey
x-refined-from:
- openapi.json
- scribiz-openapi.json