Authentication
Gesttalt uses the OAuth 2.0 authorization framework. Authorization Code with Proof Key for Code Exchange is recommended for mobile and desktop applications.
- Authorization
/oauth2/authorize- Token
-
/oauth2/token - Discovery
/.well-known/oauth-authorization-server
Registration designed for agents
Agents can discover the
auth.md registration protocol
at /auth.md. An agent sends the user's email, shows the returned confirmation address and six-digit code, and polls the token endpoint while the user signs in and approves access on Gesttalt. The agent never receives the user's password.
Start discovery at /.well-known/oauth-protected-resource/mcp. The authorization server metadata advertises the registration, claim, token, and revocation endpoints.
Dynamic client registration
Standards-aware applications can register at /oauth2/register. You can also create and revoke clients in the dashboard.
Application programming interface
Read the machine-readable OpenAPI document
or use the interactive reference. The
/api/photos
endpoints upload, list, caption, publish, unpublish, and delete photography feed entries. Scopes separate readable content from media changes, while theme sessions stay behind the Model Context Protocol authorization scope.
Model Context Protocol
Connect compatible tools to /mcp
with the mcp
authorization scope. The tools cover every publication action available in the dashboard: content, photography, media, live theme editing, publication settings, custom domains, and connected applications.
Themes
Start in the dashboard’s Theme section, where you can choose Inquiry, Studio, Paper, Ledger, Darkroom, or Field Notes. The publishing dashboard reflects the selected theme’s colors and typography. Built-in themes remain application-maintained, so improvements arrive automatically until you or an agent customize the theme.
Selecting a built-in theme replaces an existing custom theme with that theme’s templates, styles, and variables. Use it when you want a deliberate fresh starting point for the publication.
Live theme editing
Ask your agent to call create_theme_editing_session
through the Model Context Protocol. It receives an isolated copy of the active theme, the standard variable contract, and a preview address you can open beside the conversation.
Calls to update_theme_editing_session
accept partial variable changes, preserve omitted values, store the draft durably across deployments, and refresh every connected preview through Phoenix LiveView. The preview carries a visible editing sign until the session ends. The variables cover semantic colors, font families and scales, spacing, radii, sizes, and shadows. They adapt the
Theme UI (user interface) theme specification
to stable Cascading Style Sheets custom properties.
list_theme_preview_clients
reports every connected browser, its current page, viewport, and screenshot permission.
navigate_theme_preview
moves one of those browsers to a published home, article, photography, or page path. Select
Allow screenshots
in the preview before calling capture_theme_preview. The returned image comes from the browser tab and is not retained by the editing session.
Prefer variables for visual decisions and the stylesheet for component rules. The four Liquid templates define route-specific document structure:
index_template
for the home page, article_template
for blog posts, and page_template
for standalone pages. photography_template
defines the public photo feed. When the result is ready,
publish_theme_editing_session
makes the previewed theme active and redraws the preview from the persisted theme.
discard_theme_editing_session
closes the session and redraws the same page with the previously published theme.