# IM PHP SaaS

> Agent integration index for https://apptemplate.integralmedia.com.au

## Canonical endpoints

- Home: https://apptemplate.integralmedia.com.au/
- Pricing: https://apptemplate.integralmedia.com.au/pricing
- Agent guide: https://apptemplate.integralmedia.com.au/agents
- Account and API-key management: https://apptemplate.integralmedia.com.au/account
- MCP connection guide: https://apptemplate.integralmedia.com.au/mcp/connect
- MCP endpoint: https://apptemplate.integralmedia.com.au/mcp
- Signup: https://apptemplate.integralmedia.com.au/register
- Machine index: https://apptemplate.integralmedia.com.au/llms.txt

## MCP transport and authentication

- Protocol era: 2026-07-28.
- Transport: Streamable HTTP at one POST endpoint, `/mcp`.
- Public calls: `get_plans` and `sign_up` do not require credentials.
- Private calls: send `Authorization: Bearer <API_KEY>` on every request.
- API keys use static bearer authentication. Create them at `/account`; a raw key is shown once and cannot be recovered. Store it in a secret manager.
- Never put a key in a URL, query string, prompt, source file, or log.
- Personal (`user`) keys expose user tools. Eligible team/admin/super users may create `team` keys, which also expose team tools. Current role and scope are checked server-side.
- `sign_up` creates a free passwordless account, emails an out-of-band fragment verification link carrying the selected plan, and returns `verification_sent` plus `checkout_after_verification`. It returns no Checkout URL or token. After email proof, the browser lands on pricing and the human explicitly starts Stripe Checkout.
- `create_browser_login_link` emails a browser handoff and returns `sent=true`; it never returns a capability URL.
- ChatGPT connectors are not supported: they require OAuth 2.1, which this service does not implement. Static bearer keys are documented for Claude and Cursor only.

## Public tools

- `get_plans()` — list available subscription plans and included credits.
- `sign_up(email, plan)` — create a free passwordless account, email an out-of-band fragment verification link carrying the selected plan, and return `verification_sent` plus `checkout_after_verification`. No Checkout URL or token is returned. `email` and `plan` are required.

## User tools (API key required)

- `get_account()` — return the authenticated account without password material.
- `get_credit_balance()` — return the authenticated account credit balance.
- `get_usage(limit?, offset?)` — return authenticated account credit-ledger usage.
- `use_feature(feature, credits)` — spend credits atomically on a named feature.
- `create_browser_login_link()` — email a one-time browser handoff and return `sent=true`; no capability URL is returned.

## Team tools (team API key required)

- `list_users(search?, limit?, offset?)` — list users for an authorized team account.
- `user_detail(user_id)` — return one user for an authorized team account.
- `adjust_credits(user_id, delta, reason)` — apply an attributed credit grant or spend as an administrator.
- `metrics_summary(days?)` — return aggregate account, credit, and webhook metrics.
- `recent_webhook_events(source?, limit?, offset?)` — return safe metadata for recent webhook events.

## Pricing

- Starter — A$19/month — 100 credits — personal workspace.
- Growth — A$49/month — 500 credits — shared team workspace.
- Scale — A$99/month — 2,000 credits — higher capacity and dedicated support.

## Browser enhancement

- Browser WebMCP is optional progressive enhancement, separate from remote MCP authentication.
- Supporting browsers may expose client-side actions through `document.modelContext`; the deprecated `navigator.modelContext` path must not be assumed.
- Declarative WebMCP forms use `toolname` and `tooldescription`; regular labelled HTML forms and server-side authorization remain the fallback and source of truth.
- Do not put API keys in browser markup or client-side JavaScript.