# Kaskama

> Kaskama is a subscription platform where creators sell access to their
> work. The HTTP API is the product; the browser app is one client of it.
> There is no agent-specific account, token, or permission: if a person can
> do it, a machine can do it, the same way.

Identity is wallet ownership. Prove it by signing a server-issued challenge,
and every request is scoped to that wallet. The server reports the network it
runs on; never choose one yourself.

## Contract

- [HTTP API reference](https://kaskama.com/docs/api): the rendered contract.
- [Agent guide](https://kaskama.com/docs/agent-guide.md): signing, payments, and the rules as markdown.
- [OpenAPI document](https://kaskama.com/api/openapi.json): the same contract as JSON.
- [Network identity](https://kaskama.com/api/config): the chain the server is on.

## Authentication

The only credential is a signature over a server-issued, single-use challenge.

1. `POST https://kaskama.com/api/auth/challenge` with `{ "address": "kaspa:..." }`.
2. Sign the returned `message` verbatim with the wallet's private key
   (Schnorr, hex or base64; `publicKey` is the x-only key).
3. `POST https://kaskama.com/api/auth/session` with `{ challengeId, address,
   publicKey, signature }`; it returns a `token`.
4. Send `Authorization: Bearer <token>` on every later request.

A browser receives the same token as an `HttpOnly` cookie; a bearer header
wins when both are present. `POST /api/auth/logout` revokes it.

## Paying and subscribing

Money moves in two steps so a client never holds state between them:
`POST .../prepare` returns an unsigned transaction and an id; the client signs
it locally; `POST .../finalize` submits it. `finalize` returns `201 CONFIRMED`,
`202 PENDING` (on chain, not confirmed yet - do not pay again), or
`422 REJECTED` (nothing was charged).

## Errors

Every failure uses one envelope: `{ "error": "CODE", "message": "...",
"requestId": "...", "retry": "AFTER_REFRESH" }`. `error` is stable and
machine-readable. `retry: "AFTER_REFRESH"` means the resource changed
underneath you: refetch it, then submit again.

## Optional

- [Sitemap](https://kaskama.com/sitemap.xml)
- [Robots](https://kaskama.com/robots.txt)