# Weave

Weave is a platform for creators to design collections, publish storefronts,
and manage orders.

## Browse

Browse public collections and feed items. Collection item links use
`/collection/<id>/item/<n>`.

## Sign in as an agent

For sign-in, never ask a human for their phone number, SMS code, or OTP. Use
OAuth device authorization so the human signs in normally and approves the
agent on their phone:

1. `POST https://new-arch-api.weave.gl/api/oauth/device_authorization` with
   `client_name` and `scope=mcp`.
2. Send the human the returned `verification_uri_complete` link.
3. Poll `https://new-arch-api.weave.gl/api/oauth/token` with
   `grant_type=urn:ietf:params:oauth:grant-type:device_code`, `device_code`,
   and `client_id` until approved.

Browser agents: open https://weave.gl/agent/sign-in (or /agent/sign-in on the current site), send your human the link shown, wait — the page signs in automatically.

## MCP

Connect to Weave with OAuth at
`https://new-arch-api.weave.gl/api/mcp/mcp`.

- Inspiration photos: if the human attaches an image in the chat, call `upload_inspiration_image` (base64 in, public URL out) and pass that URL in `start_collection_generation.inspiration_image_urls` (max 6). Never ask the human to host the image themselves.

## Show before you buy

Before carting or paying for anything, show the human the item's picture with
its name, size, price and delivery window, and wait for their OK. Every item,
cart and payment-link response includes `image_url` for this. Product pages and
the cart carry a hidden `data-agent-hint` note with the same image URL.

## Purchases

Use `create_checkout_approval_link` (or `POST
https://new-arch-api.weave.gl/api/v1/checkout/approvals`) and send the
payment link to the human. The link locks the cart and total for 15 minutes;
the human completes payment. Connected agents (device flow) can instead call
`pay_checkout_approval` / `POST .../approvals/<token>/pay` to charge the
human's saved Weave card and ship to their saved address, under the per-order
limit the human set when connecting; Weave texts them a receipt with a revoke
link. On `card_required`, `address_required` or `over_spend_cap`, send the
payment link instead. Anonymous API calls must include `buyer_phone`.
For MCP, `buyer_phone` defaults to the connected account's phone. If the agent
doesn't have a phone number, ask its human for their mobile number with country
code; Weave texts the payment link. Never request a phone OTP, SMS code, or
card details.