# Scrollhaus authentication

## Public website and catalogue

Public marketing pages, recorded previews and GET https://scrollhaus.ai/api/catalog.json require no authentication. Only entries explicitly marked free have a public build handoff. Public metadata does not grant access to premium code or member data.

## Paid remote MCP

Endpoint: https://mcp.scrollhaus.ai/mcp
Transport: Streamable HTTP; MCP protocol 2025-06-18.

An active Yearly or Lifetime Scrollhaus membership is required. New Monthly membership does not include MCP. Eligible legacy plans retain their original access; the Account page is authoritative. Sign in at https://scrollhaus.ai/account/ and create a member MCP key using the account controls. Store the key in the MCP client's protected credential configuration and send it in the Authorization: Bearer header.

This is a member-issued API-key flow, not an OAuth authorization-server or OpenID Connect provider. Do not attempt dynamic client registration or send Google/Supabase login tokens to the MCP endpoint. Scrollhaus does not publish a fictitious OAuth issuer to represent this key flow.

Never put keys in URLs, public code, chat messages, analytics, screenshots or logs. Do not share one customer's key with another account. Revoke unused keys from the account page.

## Errors and limits

- 401: key missing, invalid, revoked, expired or not entitled. Sign in and check the current membership/key. Do not retry without a valid key.
- 429: request allowance or burst limit reached. Observe Retry-After. MCP includes 1,000 requests per UTC day for eligible plans; website prompt-copy limits are separate.
- 503: membership verification unavailable. Access fails closed; retry later. Do not fall back to anonymous access.

Documentation: https://scrollhaus.ai/mcp/
Plans: https://scrollhaus.ai/pricing/
Support: admin@scrollhaus.ai