# mockmsg agent skill

1. Read https://www.mockmsg.com/docs (plain text: https://www.mockmsg.com/llms-full.txt). mockmsg is in beta; the conversation schema may change. Fetch https://www.mockmsg.com/schema/conversation.json and check its version before sending. Read the API contract at https://mvp-api.mockmsg.com/api-docs/openapi.json for current request and response schemas.
2. Create an account at https://www.mockmsg.com/login using an email address and the emailed sign-in code; the same flow signs in existing accounts. Have the account owner handle browser approval and funding. Never request their password.
3. Device login: POST JSON scopes to https://mvp-api.mockmsg.com/oauth/device/code. Give the owner the returned verification_uri and user_code. Keep device_code secret; poll /oauth/token using URL-encoded form data no faster than interval, handling pending, slow_down, denial and expiry as the docs specify. Save the short-lived access_token privately; use Authorization: Bearer TOKEN for /v1 requests. There is no refresh token.
4. Quote: author one timeline with snapshots, validate it against the current schema, and save it with POST /v1/threads. POST /v1/exports/quote with the returned thread_id and snapshot selector. This charges nothing. Check quote_id, price_cents, screens, expires_at (RFC 3339, fifteen minutes after issue) and schema_id. QUOTE_REQUIRED means obtain and include a quote; QUOTE_EXPIRED means quote again; QUOTE_NOT_YOURS means not found, use your own quote; QUOTE_STALE means re-quote the changed input or selector. Reconfirm any new price against the operator's budget.
5. Render a preview with POST /v1/preview using the same timeline and selected snapshot. Inspect the returned spoiled/watermarked image/webp; it is not an export and costs no balance. If you edit the timeline, update the saved thread and obtain a fresh quote before buying.
6. Pay only from the operator-funded balance: GET /v1/balance and compare balance_cents with the accepted price_cents. Balances are pre-funded by a person in the browser. An agent spends a balance; it does not top one up. If insufficient, stop and ask the operator to fund the Account page, then check balance again. Never initiate Stripe Checkout yourself. Re-quote if the quote expires while waiting. The next step performs the debit; there is no separate agent top-up or payment call. Top-ups are not refundable, except where the law requires it. Each top-up creates credit that lapses twelve months later; bonus credit follows its top-up, and spending draws on the oldest credit first. Expiry rows are written when a balance is read, so the ledger is correct at every observation, not at every instant.
7. Export: POST /v1/exports with thread_id, the same snapshot selector and quote_id, plus a unique Idempotency-Key. The single-use quote's stored price is charged. Retry an uncertain purchase with the identical key and body, never a fresh key; an idempotent replay consumes no second quote. Poll GET /v1/exports/EXPORT_ID until rendered or failed, then download the returned URLs. A failed export is automatically refunded; inspect balance entries rather than buying blindly. Keep all credentials private and revoke device access when finished.

## Credential safety

Never send the bearer token to other origins, including export download URLs. Never commit passwords, tokens or device codes.