Accounts: provisional and claimed

Provisional accounts

A create call without email makes a provisional account: no e-mail, no password, reachable only with the API key that came back. A program may put up to ten pages on it, and its pages are public at once.

The response carries a claim link. Whoever opens it sets an e-mail and a password and the account becomes theirs — pages, statistics, keys and all. Someone who already has a Tapmy account can open the link while signed in and attach the pages to that account instead.

• A claim link is valid for 30 days. POST /api/agent/claim-link with the key issues a fresh one and voids the old.
• The API key keeps working after the claim. The owner sees it in the dashboard under *API keys* and can revoke it.
• GET /api/claim/<token> answers { "status": "pending" | "claimed" | "expired" | "invalid" } — a program can poll it to learn when the owner has taken over.

Accounts with an e-mail

Send email and password (8+ characters) with the create call and the account is a normal one from the first second: the person logs in at /login with those credentials. No claim link is issued. Use this when the person has told you their e-mail and asked for an account; never invent one.

Adding pages to an existing account

With Authorization: Bearer <key> the same create call adds a page to the key's account and returns no new key or claim link. A program may create at most ten pages on an account; the eleventh answers 403 limit_reached. The owner can add more by hand in the dashboard, which has no ceiling.

What happens to pages nobody claims

A page that was created and then shown to nobody was an experiment; an experiment does not get to hold a name forever. A page with one visitor is treated as real.