# webhook-inbox

> Machine-buyable ephemeral HTTPS inbox — mint URL, capture POSTs, list as JSON. Live host `https://inbox.kymac.co`.
> **Sole advertised entry:** this file (`GET /llms.txt`). Do not start at OpenAPI, MCP, or `/`.
> Registry id: `co.kymac.inbox/webhook-inbox`. Capability keywords: webhook inbox, request bin, capture post.

Bot-alone path: this file → get key → quote → mint inbox → POST capture_url → list events. No human mid-loop. Checkout intent-only until confirm. Rotate/revoke via `/keys/rotate` or `/keys/revoke`.

GET /health is public. GET `/incidents` is public status (not an install entry). Keys at POST /keys (`whi_…` once). First issue = 1 free credit. Prefer `Authorization: Bearer`.

Install sequence:

1. GET `/llms.txt`
2. POST `/keys`
3. Bearer auth
4. GET `/credits/quote?op=inbox`
5. POST `/inbox` → `capture_url`
6. Public POST to `capture_url` (no key) with any body. Public capture URL is not an install entry.
7. GET `/inbox/{id}/events`
8. packs → checkout (`credits_pending`) → confirm; optional DELETE `/inbox/{id}`

Debit: 1 credit on successful mint (`inbox_mint`) only. Capture/list do not debit. Second mint without credits → 402 `next=buy credits`.

## Fail shapes

`code`/`message`/`retryable`/`error`/`next` (`refresh key` | `buy credits` | `retry` | `fix request`).

MCP: `POST /mcp` (not install entry). `GET /.well-known/mcp.json` + `GET /mcp.json` pointed only from this file. Env `WEBHOOK_INBOX_API_KEY`.

Non-goals: outbound webhooks; long-term storage; live Stripe until unlock-live.