Security & PermissionsOAuth 2.1 / Scopes

Authentication & Scopes

Krafto implements granular, least-privilege permission scoping to give developers and users complete control over what autonomous AI agents and external applications can access.

Authentication Methods

OAuth 2.1 Bearer Token

Standard for MCP clients and user sessions. Issued via PKCE authorization or personal token generation in the MCP dashboard. Transmitted in the Authorization: Bearer <token> header.

Developer API Key (X-Api-Key)

Standard for backend microservices and static pipelines. Generated under approved developer apps and transmitted in the X-Api-Key: kr_live_... header.

# 1. Authenticate with an MCP Personal Access Token
curl -X POST https://api.trykrafto.xyz/mcp \
  -H "Authorization: Bearer mcp_live_981a7cf..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "get_account_info", "arguments": {}}}'

# 2. Authenticate REST API with Developer API Key
curl https://api.trykrafto.xyz/api/v1/assets \
  -H "X-Api-Key: kr_live_4128f9..."

Permission Scopes Catalog

Every MCP tool and REST endpoint enforces an explicit scope requirement.

catalog:readCatalog Read

6 associated tools

Browse active categories, search assets, read metadata, and fetch structured AI manifests.

search_assets get_asset_details get_categories get_asset_manifest list_bundles get_asset_reviews

library:readLibrary Read

4 associated tools

View assets already owned by the authenticated user and verify license entitlements.

list_library check_entitlement get_order_history list_wishlist

library:claimLibrary Claim

1 associated tools

Claim free assets or redeem subscription tier quota allocations at zero wallet charge.

claim_free_asset

library:downloadLibrary Download

2 associated tools

Generate signed, time-limited download URLs (S3/Cloudflare R2) for owned assets.

get_download_url get_raw_download_url

account:readAccount Read

2 associated tools

Inspect basic account profile, tier status (Free, Go, Pro, VIP), and remaining monthly quota.

get_account_info get_wallet_balance

wallet:spendWallet Spend

1 associated tools

Execute autonomous purchases using the user's preloaded Krafto Wallet balance.

purchase_asset_with_wallet

wishlist:manageWishlist Management

2 associated tools

Add or remove assets from the user's personal bookmarks and favorites list.

add_to_wishlist remove_from_wishlist

reviews:writeReviews & Ratings

1 associated tools

Submit feedback, ratings (1-5 stars), and written reviews for purchased assets.

submit_asset_review

bundles:manageCustom Bundles

1 associated tools

Compose, package, and publish customized multi-asset packs with combined pricing.

create_bundle

Wallet Spending Safety Guardrails

When granting the wallet:spend scope to an AI coding agent, tools like purchase_asset_with_wallet accept a required confirmMaxPriceINR safety ceiling argument. If the live asset price exceeds this threshold, the transaction is immediately rejected with error code PRICE_CEILING_EXCEEDED without deducting funds.

Protocol Architecture

MCP Tools Reference