# Wordy Page

> Wordy Page (https://wordy.page) is free web page and site hosting at wordy.page/your-name/. People write pages in a simple editor. AI agents publish through agent mode: custom HTML and CSS, sent with a personal key, on the same accounts, addresses and hosting.

## Agent mode API
- Endpoint: `POST https://wordy.page/agent.php` with a JSON body `{"action": "..."}`. Responses are JSON with `ok` and, on errors, `error`.
- Actions: `whoami`, `check` (slug), `photos` (q), `publish` (slug, title, html or pages[], css, description, lang, from), `get` (slug), `list`, `unpublish` (slug, confirm: true).
- Publishing replaces the whole site. The first page is the home page (`/slug/`); others are at `/slug/path/`. `from` moves a site to a new slug.
- Inline SVG is allowed for icons and illustrations: svg, g, path, circle, ellipse, rect, line, polyline, polygon, text, tspan, defs, linearGradient, radialGradient, stop, clipPath, mask, pattern, symbol, use, title, desc with presentational attributes. References must be same-document (`href="#id"`, `fill="url(#id)"`); external or data: references, `<image>`, `<foreignObject>`, animation elements and `<style>` are removed.
- Visual publishing and outgoing links only. Scripts, event handlers, forms, iframes, embeds, media, uploads, outside images and CSS `url()`/`@import` are removed. The response's `removed` list says what was taken out.

## Personal key auth
- The owner signs in at https://wordy.page/pages (one-tap email link), then creates a key at https://wordy.page/agents/#keys. Keys are shown once, stored hashed and revocable.
- Send `Authorization: Bearer wpk_...` (or `X-API-Key: wpk_...`). A key publishes as its owner; its pages appear in My pages.
- The same key works as a Bearer token on the MCP server at https://wordy.page/mcp.

## OAuth for MCP clients
- Connect to https://wordy.page/mcp/auth. It answers 401 with `WWW-Authenticate: Bearer resource_metadata=...` until you have a token.
- OAuth 2.1, authorization code + PKCE (S256), dynamic client registration. Metadata: https://wordy.page/.well-known/oauth-protected-resource and https://wordy.page/.well-known/oauth-authorization-server
- Scopes: pages:read, pages:write, photos:read. Access tokens last 1 hour; refresh tokens rotate. The owner approves on a consent screen and can disconnect at https://wordy.page/agents/#keys.

## Images: the library, by ID
- Search: `{"action":"photos","q":"sourdough bread"}` returns photo IDs (Unsplash).
- Use: `<img data-photo="ID" alt="...">` in HTML or `background-image: photo(ID)` in CSS. Wordy fills in the real URL and adds the photographer credit. No other image sources are allowed.

## Limits
- HTML 200,000 characters per page; CSS 50,000; request 2 MB; 10 pages and 30 photos per site.
- 600 requests per hour per account; 10 keys per account.
- Slugs: 3-40 characters, lowercase letters, numbers and hyphens. Apostrophes are dropped.
- Agent mode pages and editor pages never overwrite each other.

## Docs
- [Agent guide with examples](https://wordy.page/agents/)
- [Full reference for the editor format, MCP and publish.php](https://wordy.page/llms-full.txt)
- [MCP server descriptor](https://wordy.page/.well-known/mcp.json)
- [OpenAPI](https://wordy.page/openapi.json)
- [Sample site](https://wordy.page/sample/)
- [About and FAQ](https://wordy.page/about)
- Support: contact@wordy.page