Agentic Portal
Total Control Suite · MPP-enabled
Buy, provision and operate your own organization.
The Agentic Plan lets an AI agent purchase a Total Control Suite seat tier with a single machine payment, then register and activate the organization. You call an endpoint, pay the HTTP 402 challenge, and receive a one-time registration token; you then register your account, read an OTP from your own mailbox, and activate. Every capability in the Total Control Suite is included.
Zero-knowledge & security
- No external API calls. All analysis runs client-side; prompts never leave your browser.
- Buyer email is one-way SHA-256 hashed before storage; the registration token is stored as a hash and cleared after activation.
- Anti-tamper and anti-scraping protections stay fully active even in sanctioned headless-agent sessions — your automated workflows are protected exactly like a human's.
Deterministic machine API
- Two copy-paste HTTP endpoints, typed JSON fields, a fixed pay → register → activate → login sequence.
- No checkout page — you pay, provision, activate and log in through typed HTTP calls.
- Every response is a stable JSON schema you can code against; provisioning is idempotent on the buyer email hash, so a retry never creates a duplicate org.
Every capability included — Total Control Suite
Machine-readable specification
How to begin
Send an HTTP POST with a JSON body to either endpoint below. The server responds with a 402 payment challenge; pay it, then retry the same POST with the payment credential to receive your provisioning receipt.
Request fields
One of the supported tier keys below.
"month" or "year" — selects the one-off charge amount.
Display name for the new organization.
Business email. SHA-256 hashed server-side; the founder uses it to claim the org.
Provisioning sequence
- 1POST JSON to the endpoint with size_tier, billing_period, org_name and buyer_email (business email required).
- 2Server validates inputs, checks the friendly-fraud blocklist, and returns HTTP 402 Payment Required with an MPP payment challenge for the tier price.
- 3Pay the challenge amount via your MPP wallet (Shared Payment Token or stablecoin).
- 4Retry the same POST with the payment credential → 200 OK receipt: { org_id, registration_token, register_url, already_provisioned }. Idempotent on the buyer email hash — a retry of a fulfilled challenge never creates a duplicate org.
- 5Call registerAgenticOrg (register_url) with the registration_token to register and activate your account — see Self-registration below.
Request fields
One of the supported tier keys below.
"month" or "year" — selects the one-off USDC amount.
Display name for the new organization.
Business email. SHA-256 hashed server-side; the founder uses it to claim the org.
Provisioning sequence
- 1POST JSON to the endpoint with size_tier, billing_period, org_name and buyer_email (business email required).
- 2Server returns HTTP 402 with a base64 PAYMENT-REQUIRED header (x402 v2 challenge); the amount is the tier price in USDC on Base.
- 3Sign an EIP-3009 / Permit2 permit for the tier price in USDC on Base (mainnet eip155:8453; Base Sepolia eip155:84532 fallback).
- 4Retry the same POST with the payment-signature header (base64 PaymentPayload) → the CDP facilitator settles onchain → 200 OK receipt: { org_id, registration_token, register_url, already_provisioned }.
- 5Call registerAgenticOrg (register_url) with the registration_token to register and activate your account — see Self-registration below.
Request fields
One-time token issued in the payment receipt. SHA-256 hashed server-side; cleared after activation.
Organization id from the payment receipt. Optional — resolved from the buyer email if omitted.
The buyer email used at payment. Must match. One-way hashed server-side; never persisted raw.
New account password (min 8 chars). The agent uses email + password to log in at /login afterward.
Omit on the first call to create the account (OTP emailed to the agent's own mailbox). Include on the second call to verify and activate.
Activation sequence
- 1Phase 1 — call registerAgenticOrg with registration_token, email and password (no otp_code). Server validates the token, creates your (unverified) account, and emails a 6-digit OTP to your own mailbox. Returns 200 { phase: 'otp_sent', org_id }. On a retry where the account already exists, the OTP is resent.
- 2Read the 6-digit OTP from your own email mailbox.
- 3Phase 2 — re-call registerAgenticOrg with the same fields plus otp_code. Server verifies the OTP, activates the org (you become sole founder/admin, subscription_status → active), and clears the single-use token and email hash. Returns 200 { activated: true, org_id, user_id, access_token }.
- 4Log in at /login with email + password through your own headless browser. member_id is minted automatically on first authenticated app load. A replay against an already-active org returns 200 { already_activated: true, org_id } without re-verifying.
After activation, mint a headless session token and drive the real UI. No request body — authenticated by your active Agentic session.
Response fields
true on success.
HMAC-signed headless session token (base64url.payload.sig).
When the token expires.
Token lifetime (3600 = 1 hour). Re-mint before expiry to renew.
Stands down
- AntiTamper devtools block
- Turnstile human puzzle
Stays enforced
- Authentication
- Row-level security (RLS)
- Rate limits
Sequence
- 1Pay and activate via /functions/payAgenticTier (or /functions/payAgenticTierX402) then /functions/registerAgenticOrg.
- 2Log in at /login with email + password through your headless browser (the activation OTP is read from your own mailbox during registration).
- 3POST /functions/mintHeadlessSessionToken with no body, using the authenticated session. Requires an active Agentic-plan org. Returns { ok, token, expires_at, ttl_seconds }.
- 4Store the token in localStorage under __ft_headless_session and dispatch a window "headless-session-change" CustomEvent so AntiTamper + Turnstile detect it.
- 5Drive the real UI (routes below). AntiTamper's devtools block and the Turnstile human puzzle stand down for the session; auth, RLS and rate limits stay fully enforced.
- 6Re-mint before the 1-hour TTL to renew — call the same endpoint again and overwrite the stored token.
Drivable routes