Pubstech API docs
Public discovery metadata is available from the homepage and from the
/.well-known endpoints. The site front door stays on
https://pubstech.com, while the auth server is published on
https://app.pubstech.com/auth/v1.
Discovered resources
Auth metadata
The site proxies Supabase Auth through https://app.pubstech.com/auth/v1.
The discovery document and JWKS URI are exposed there directly.
Public surface inventory
| Method | Path | Purpose | Access |
|---|---|---|---|
GET |
/openapi.json |
Root OpenAPI discovery document | public |
GET |
/docs/api/openapi.json |
Mirrored OpenAPI copy for the docs page | public |
GET |
/.well-known/ucp |
Universal Commerce Protocol profile | public |
GET |
/.well-known/api-catalog |
RFC 9727 API catalog | public |
GET |
/.well-known/agent-skills/index.json |
Agent skills discovery index | public |
GET |
/.well-known/openid-configuration |
OpenID discovery wrapper | public |
GET |
/.well-known/oauth-protected-resource |
OAuth protected resource metadata | public |
GET |
/.well-known/mcp/server-card.json |
Browser-exposed MCP server card | public |
GET |
/healthz |
Site health check | public |
POST |
/admin/onboarding/pub-owner |
Public onboarding intake | public |
POST |
/admin/login-handoffs |
Create a login handoff after sign-in | auth |
POST |
/admin/login-handoffs/redeem |
Redeem a login handoff | auth |
GET |
/admin/security/state |
Read admin security state | auth |
PUT |
/admin/security/profile |
Update admin security profile | auth |
POST |
/admin/security/challenges |
Create a security challenge | auth |
POST |
/admin/security/challenges/{challengeId}/verify |
Verify a security challenge | auth |
POST |
/payments/intents |
Create a payment intent | auth |
GET |
/payments/intents/status |
Read payment intent status | auth |
POST |
/payments/checkout/session |
Create a checkout session | auth |
GET |
/payments/checkout/session/status |
Read checkout status | auth |