# PromptEden
> Monitor your brand in AI answers. Compare competitors, inspect cited sources, and ask Eden to explain the evidence.

Plans and API access: Starter ($49/mo), Pro ($129/mo), and Business ($349/mo) all include REST API, hosted MCP, and OAuth read access. Agent self-sign-up (POST /api/v1/agent/sign-up) creates a $0 Agent workspace with API access and 500 monthly credits once the human owner confirms email.

Monitored answer engines (present tense means live today): ChatGPT, AI Overviews, AI Mode, Gemini, Claude.

Important URLs:
- App: https://app.prompteden.com/
- Agent skill: https://app.prompteden.com/skill.md
- OpenAPI JSON: https://app.prompteden.com/openapi.json
- OpenAPI YAML: https://app.prompteden.com/docs/openapi.yaml
- Agent manifest: https://app.prompteden.com/agents.json
- OAuth protected resource metadata: https://app.prompteden.com/.well-known/oauth-protected-resource/api/mcp
- OAuth authorization server metadata: https://app.prompteden.com/.well-known/oauth-authorization-server
- Hosted MCP: https://app.prompteden.com/api/mcp

Phase-1 OAuth supports only 13 public reads: get_account, list_monitors, get_results, list_providers, list_projects, get_project, preview_displacement_scan, agent_status, analytics_get_property, analytics_get_verification, analytics_get_traffic, analytics_get_overview, analytics_list_goals. REST rejects poa_ tokens with 401 invalid_token. Writes, private tools, agent_sign_up, agent_sign_in, and check_approval are unavailable through OAuth. OAuth uses exact scopes and the consent project ceiling; an empty ceiling allows no projects. API-key hosted writes can use the approval bridge and check_approval.

Existing-account delegated auth:
- Do not ask the human for their PromptEden password.
- Preferred API-key handoff: ask an owner/admin to open Workspace Settings > API Keys, create a scoped key for this agent, and paste the one-time pe_ key back.
- OAuth handoff: fetch /.well-known/oauth-authorization-server, construct an authorization-code + PKCE S256 URL for your registered public client, and ask the human to approve the scopes.
- The old /api/v1/agent/sign-in password path is compatibility-only and should not be used as a BYOA handoff for an existing human account.

Trust rules:
- The safety floor is never bypassed: prompt-injection defense, budget/credit ledger, and cross-tenant scoping.
- Write, spend, and publish operations use approvals or standing policies.
- For existing human accounts, use Workspace Settings > API Keys or OAuth. Do not request passwords.