---
title: "YouSpot docs for developers and agents"
description: "The MCP server, OAuth 2.1, the HTTP endpoints, and the discovery files that describe them."
canonical: https://youspot.com/docs
last-updated: 2026-09-04
---

# YouSpot docs for developers and agents

> The MCP server, OAuth 2.1, the HTTP endpoints, and the discovery files that describe them.

## Pages

- [YouSpot for developers and agents](https://youspot.com/docs/overview.md): What YouSpot exposes to code: an MCP server, OAuth 2.1, public profile endpoints, and the discovery files that describe them.
- [YouSpot API authentication](https://youspot.com/docs/authentication.md): YouSpot is an OAuth 2.1 authorization server for agents: dynamic client registration, PKCE S256, refresh-token rotation. Members can also mint a long-lived API token by hand.
- [YouSpot MCP server](https://youspot.com/docs/mcp.md): Connect Claude, ChatGPT, Cursor or Claude Code to https://youspot.com/mcp and let an agent read and write your own CRM.
- [YouSpot HTTP API](https://youspot.com/docs/api.md): The endpoints YouSpot answers over plain HTTP: public profile data with no auth, and the MCP tool surface with a bearer token.
- [YouSpot API versioning, deprecation and rate limits](https://youspot.com/docs/versioning.md): How the YouSpot API is versioned, what notice you get before anything is removed, the RateLimit headers every limited endpoint answers with, and how Idempotency-Key makes a retry safe.
- [Paying for YouSpot as an agent](https://youspot.com/docs/payments.md): What YouSpot sells, who can buy it, and the commerce protocols an agent can negotiate against: a UCP discovery profile at /.well-known/ucp and the ACP checkout surface.
- [YouSpot security and vulnerability disclosure](https://youspot.com/docs/security.md): How to report a security issue to YouSpot, Inc., what is in scope, and what we commit to in return. A summary of the policy published at /security.

## Machine endpoints

- [llms.txt](https://youspot.com/llms.txt): this site, for language models
- [llms-full.txt](https://youspot.com/llms-full.txt): the long-form version
- [sitemap.xml](https://youspot.com/sitemap.xml): every public page with a last-modified date
- [index.md](https://youspot.com/index.md): the home page as markdown
- [agents.md](https://youspot.com/agents.md): what an agent can do here, in one page
- [MCP server](https://youspot.com/mcp): streamable HTTP; initialize and tools/list need no credential
- [MCP server card](https://youspot.com/.well-known/mcp/server-card.json): the endpoint, transport and every tool
- [MCP manifest](https://youspot.com/.well-known/mcp.json): every MCP server on this domain, each with its own card
- [auth.md](https://youspot.com/auth.md): how an agent gets a credential
- [agent identity](https://youspot.com/agent/identity): what identity you can hold here, and who you are holding
- [OpenAPI 3.1](https://youspot.com/openapi.json): every HTTP endpoint that exists
- [Agent Plugins manifest](https://youspot.com/plugin.json): both MCP servers and the skills, in one bundle
- [ChatGPT plugin manifest](https://youspot.com/.well-known/ai-plugin.json): the OpenAI manifest, naming the OpenAPI spec, the OAuth endpoints and the logo
- [API catalog](https://youspot.com/.well-known/api-catalog): RFC 9727
- [agent index](https://youspot.com/v1): every endpoint, and what each one costs in credentials
- [docs MCP server](https://youspot.com/mcp/docs): the public pages over MCP, no credential at all
- [sandbox MCP server](https://youspot.com/mcp/sandbox): the read tools over a demo account, no credential and no signup
- [sandbox](https://youspot.com/sandbox): the sandbox described: what is mounted under /sandbox, and whether the demo account is seeded
- [ask](https://youspot.com/ask): a question in plain words, answered from these pages
- [A2A agent card](https://youspot.com/.well-known/agent-card.json): JSON-RPC at /a2a
- [OAuth 2.1 authorization server metadata](https://youspot.com/.well-known/oauth-authorization-server): RFC 8414
- [protected resource metadata](https://youspot.com/.well-known/oauth-protected-resource): RFC 9728
- [Agent Skills index](https://youspot.com/.well-known/agent-skills/index.json): skills an agent can load
- [ARD catalog](https://youspot.com/.well-known/ard.json): agent resource discovery
- [UCP business profile](https://youspot.com/.well-known/ucp): what an agent can transact with here, and what it cannot
- [security.txt](https://youspot.com/.well-known/security.txt): how to report a vulnerability
- [Web Bot Auth key directory](https://youspot.com/.well-known/http-message-signatures-directory): the key YouSpot agents sign their own requests with