Base URL https://app.openstela.io. Create a key in the app under Account → API keys; it is shown once. Send it as Authorization: Bearer alk_…. A key has the rights of your account except deleting it — revoke it the moment it leaks.

Endpoints under /api/verify, /api/market and /api/public need no key.

Upload the file (mp3 / m4a / wav / jpg / png / webp / mp4 / webm) or paste a link. The response carries the work with its authorship record and fingerprints; the nightly batch anchors it. Music needs both rights confirmed; AI-assisted work needs human_contribution. Add bind_slug to bind it to one of your characters in the same call.

curl https://app.openstela.io/api/aworks \
  -H "Authorization: Bearer alk_…" \
  -F "[email protected]" \
  -F "title=Midnight Rain" -F "attribution=M. Vale" \
  -F "claimed_created_at=2026-09-08" -F "declaration=own" \
  -F "music_composition=true" -F "music_recording=true" \
  -F "ai_generated=true" -F "tools=Suno" \
  -F "human_contribution=wrote the lyrics; chose key, tempo and structure" \
  -F "bind_slug=lumen"

From a link — a snapshot of the page (or the oEmbed record for YouTube) is what gets fingerprinted:

curl https://app.openstela.io/api/aworks/link \
  -H "Authorization: Bearer alk_…" -H "Content-Type: application/json" \
  -d '{"url":"https://youtu.be/…","declaration":"own","attribution":"M. Vale"}'

Bind later instead:

curl -X POST https://app.openstela.io/api/aworks/54b9cdf3/bind \
  -H "Authorization: Bearer alk_…" -H "Content-Type: application/json" \
  -d '{"slug":"lumen"}'

Five calls. The ID is public on the market by default as “not for sale”; use PATCH /api/packs/{slug}/listing to mark it private or to put a price on it.

# 1 create · 2 upload 1–4 pictures (drafts the spec) · 3 confirm · 4 finalize · 5 issue the ID
curl -X POST https://app.openstela.io/api/packs -H "Authorization: Bearer alk_…" \
  -H "Content-Type: application/json" \
  -d '{"slug":"lumen","name":"Lumen","char_type":"non_human","one_line":"a lantern spirit"}'
curl -X POST https://app.openstela.io/api/packs/lumen/import -H "Authorization: Bearer alk_…" \
  -F "[email protected]" -F "[email protected]"
curl -X POST https://app.openstela.io/api/packs/lumen/import/confirm -H "Authorization: Bearer alk_…" \
  -H "Content-Type: application/json" -d '{}'
curl -X POST https://app.openstela.io/api/packs/lumen/finalize -H "Authorization: Bearer alk_…"
curl -X POST https://app.openstela.io/api/packs/lumen/identity -H "Authorization: Bearer alk_…"

Any fingerprint — a spec version, an authorship record, a binding, an evidence record, a contract — can be checked without a key. The answer separates registered, anchored and verified on chain; only the last one needs no trust in us.

curl https://app.openstela.io/api/verify/<sha256>

The Proof Pack is a zip with a PDF for people and record.json for machines, including the Merkle proof for every anchored leaf:

curl -OJ https://app.openstela.io/api/aworks/54b9cdf3/proof-pack.zip \
  -H "Authorization: Bearer alk_…"

The market lists public characters and works; anything without a price is “not for sale, contact the holder”:

curl https://app.openstela.io/api/market/list

Nothing to install. Point any MCP client at https://app.openstela.io/mcp with the same key in an Authorization header. Twelve tools: list characters and works, get a work with its record and proofs, register a work (URL or base64 file), bind, public switch, get a character, public character, public work, verify, search the market, and read a creator account (YouTube channel / Civitai user page) to register its works one by one.

claude mcp add --transport http openstela https://app.openstela.io/mcp \
  --header "Authorization: Bearer alk_…"

Cursor / Windsurf / other clients:

{"mcpServers": {"openstela": {"url": "https://app.openstela.io/mcp",
  "headers": {"Authorization": "Bearer alk_…"}}}}

claude.ai and ChatGPT connectors: no key needed. Add a custom connector with the URL https://app.openstela.io/mcp; you are sent to OpenStela to sign in and approve, and the access shows up under Account → API keys where you can revoke it. (OAuth 2.1 with PKCE and dynamic client registration; discovery at /.well-known/oauth-authorization-server.)

Deliberately absent: delete, deal signing, payment, issuing IDs. Tools that a model calls on its own must not spend money or do anything irreversible; those actions stay in the app, behind a person's click.

• Free: 50 characters per account, 300 MB for uploaded works, daily caps on imports and registrations (returned as 429). MCP file uploads: base64 up to 16 MB, otherwise paste a link.
• Errors are JSON {"detail": …} with the usual status codes; 423 means the character is locked by a pending deal.
• What is registered is what your account declared. A record proves that specific data existed at a date; it does not prove authorship, ownership or non-infringement. Registering something you have no rights to is a breach of the Terms.
• Deal-room writes (drafting, signing, paying), billing and admin are not part of the public API.