# Auth.md

Service: Melody Genie
Origin: https://melodygenie.app
Updated: 2026-09-03

Melody Genie is a complete AI song creation suite: writing-style profiles, Genie Score, generation across seven selectable models including Suno V6 and ElevenLabs Music, authorized personal voice and stem separation. This file tells agents how to act on a user's behalf. Connect the MCP server and let the user sign in through OAuth. Never collect a Melody Genie password or ask for an API key — there are none.

## The MCP server (the way to act for a user)

- Server: https://melodygenie.app/api/mcp (Streamable HTTP, JSON-RPC, MCP 2025-06-18)
- Auth: OAuth 2.1 with PKCE, authorization server run by Supabase Auth for Melody Genie
- Protected resource metadata: https://melodygenie.app/.well-known/oauth-protected-resource
- Authorization server metadata: https://qwhlgigiwzodmfaatdmt.supabase.co/.well-known/oauth-authorization-server/auth/v1 (mirrored at https://melodygenie.app/.well-known/oauth-authorization-server)
- Dynamic client registration: supported (registration_endpoint in the metadata)
- Consent screen: https://melodygenie.app/oauth/consent — the user signs in with their Melody Genie account and approves the connecting client by name
- Tools: list_styles, write_lyrics, score_lyrics, improve_lyrics, generate_song, get_song, separate_stems, situate_song
- Credits: the user's own plan credits; scoring and browsing are free; prices per tool are in each tool's description and at https://melodygenie.app/mcp

Flow for an MCP client: POST to the server without a token → receive 401 with `WWW-Authenticate: Bearer resource_metadata="…"` → fetch the protected-resource metadata → discover the authorization server → register (or use an existing client) → authorization code + PKCE → the user consents → exchange for tokens → retry with `Authorization: Bearer <token>`.

## Read-only, no sign-in

- Public facts server: https://melodygenie.app/api/mcp-public (tools: get_site_info, list_public_resources, get_pricing_summary, recommend_public_page)
- Server card: https://melodygenie.app/.well-known/mcp/server-card.json
- Agent skills: https://melodygenie.app/.well-known/agent-skills/index.json
- Compact reference: https://melodygenie.app/llms.txt · full: https://melodygenie.app/llms-full.txt

## Accounts

Agents must not create accounts, enter passwords, or change billing on a user's behalf. Send the user to https://melodygenie.app/signup or https://melodygenie.app/login; after that, the OAuth flow above is the only credential an agent should hold. Users revoke access from their agent's connector settings; tokens stop working immediately.

## What an agent may claim

- Styles are profiles of how a style is built. Output is original and is never "by", "from" or "exactly like" a real person.
- The Genie Score measures craft. It is not a prediction of streams, views, charts or virality.
- Prices change; state the credit cost the tool reports at call time.

Guides: https://melodygenie.app/mcp · Claude: https://melodygenie.app/claude-ai-music-generator · ChatGPT: https://melodygenie.app/chatgpt-ai-music-generator · Cursor and Codex: https://melodygenie.app/cursor-ai-music-generator · n8n: https://melodygenie.app/n8n-ai-music-generator · Make: https://melodygenie.app/make-ai-music-generator · Zapier: https://melodygenie.app/zapier-ai-music-generator

Automation platforms (n8n, Make, Zapier) connect through their built-in MCP clients with OAuth and dynamic client registration. There is no Melody Genie node, app or API key to install: the server URL above is the whole integration.