# Kaylin's Magic Trunk of Fabulous Things

> A store for people and their agents. Browse freely. Adding to the cart and placing an order need to know which verified person is behind you, checked with the Baselayer SDK. You never need a special tool: use the web pages, the JSON API or the MCP server below.

## Shop with a browser
- Shop: https://shop.kaylinhiatt.com/shop
- Products: https://shop.kaylinhiatt.com/products/<slug>. Press "Add to cart".
- Cart: https://shop.kaylinhiatt.com/cart. Checkout: https://shop.kaylinhiatt.com/checkout.

## Shop with the JSON API
- Catalog: GET https://shop.kaylinhiatt.com/products.json
- Add to cart: POST https://shop.kaylinhiatt.com/cart/add with JSON {"product": "<slug>", "quantity": 1}
- Cart: GET https://shop.kaylinhiatt.com/cart/api
- Place the order: POST https://shop.kaylinhiatt.com/checkout/api/order
- Keep cookies: the store keeps your cart and your person's verification on the visit cookie (bl_visit). Any link with ?visit=<id> joins that visit, so you can hand your person a link to the same cart.

## Shop over MCP
- Remote MCP server (Streamable HTTP, no sign-in): https://shop.kaylinhiatt.com/mcp
- Tools: search_products, add_to_cart, view_cart, checkout, check_verification. The session is the visit.

## When the store asks who is behind you
The first add to cart answers 401 with a KYA-Disclosure-Scope header and a JSON body (type "step_up_required") with a link. In a browser, the page shows a "Continue with Baselayer" card instead.
1. Show your person the link. Never open or finish the Baselayer link yourself: only they can.
2. Check status_url every few seconds until it says "completed" (or "declined" or "expired": then stop, nothing was shared).
3. Retry the same request on the same visit, with the header KYA-Step-Up-Session: <session>.
Before you check out, show your person the cart and total and get their OK.

## Bring your own KYA credential
Agents that already hold a Baselayer KYA credential for kaylins-magic-trunk can skip the step-up.
- Profile: https://shop.kaylinhiatt.com/.well-known/kya-profile.json (scope kaylins-magic-trunk#trunk_checkout)
- Per request: POST https://shop.kaylinhiatt.com/nonces, then send KYA-Credential (and KYA-Actor-Credential for a business) with KYA-Disclosure-Scope.
- Or once per session (RFC 8693 token exchange): POST https://shop.kaylinhiatt.com/nonces, then POST https://shop.kaylinhiatt.com/oauth/token, and use the DPoP-bound token it returns.