ZZD public AI gateway · zzd_public_ai_gateway_v3
Resource: 12 · Authentication and safety / 风险边界
Canonical map: https://zzd.show/docs/ai/map.json
Full handbook: https://zzd.show/llms-full.txt
REST capabilities: https://zzd.show/api/v1/capabilities/

# Authentication and safety contract

## Available now: two authorization surfaces

A third-party coding agent may operate the normal ZZD UI in a browser
the user controls. If the user is already signed in, the browser
sends the existing session automatically. The model must not read,
export, print, copy, request, or store cookies, session IDs, CSRF
tokens, passwords, payment data, private keys, or unrelated personal
information.

If sign-in is needed, let the user complete it. Do not ask the user
to paste a password or cookie into chat. UI mutations remain subject
to CSRF, ownership, rate, quota, visibility, and audit checks.

The supported external automation surface is HTTPS REST v1 at
`/api/v1/`. It uses user-created, scoped, expiring, revocable
developer credentials. Fetch `/api/v1/capabilities/` before use and
send the credential only in the Authorization bearer header to
`https://zzd.show`. There is no session-cookie fallback for REST.

The exact canonical Host is a security boundary. API and credential
control-plane requests sent to `www`, `code.zzd.show`, an IP address,
an alternate port, a custom domain, or another Host receive a
featureless not-found response. Never forward the bearer across an
HTTP redirect or send it to asset/CDN/editor origins.

The user creates and revokes developer credentials from the signed-in
homepage/control plane. The recommended AI Bridge button downloads a
self-describing custom PEM container; only one is active per user and
rotating it revokes the former bearer atomically. It is explicitly
not an SSH/TLS/X.509 private key. A new raw value is delivered once
and ZZD retains a hash plus lifecycle, last-used, and revocation metadata.
Keep it in an OS keychain or permission-restricted local secret store.
Do not paste it into chat, commit it, place it in Show JavaScript, or
expose it in logs, screenshots, URLs, prompts, or final responses.

REST scopes are narrow and enforced per operation. Request only what
is necessary: `identity:read`, `shows:read`, `shows:write`,
`shows:publish`, `assets:write`, `baas:write`, and
`collections:write` are the current deployment scopes described by
the live capability response. Ownership is checked on every private
operation; another user's resource is returned as not found.

Never treat ZZD's legacy CLI secret, a BaaS app/service credential,
browser cookie, CSRF token, public User ID, Space ID, or Show ID as a
developer bearer credential. If the agent has neither a signed-in
browser nor a valid platform-issued developer credential, it must
stop at a plan or guide the user through credential creation.

This public gateway remains unauthenticated resource discovery and a
REST adoption specification. It does not itself accept mutations or
reveal credentials. Mutation requests go only to the advertised
scoped `/api/v1/` routes or the authenticated `/mcp/v1/` adapter.

## Require explicit confirmation

- publish, unpublish, or materially change access;
- submit, buy, remove, delete, or materially reprice a Sale;
- create, rotate, or revoke a credential;
- delete a Show, asset, BaaS collection, or user data;
- run a destructive BaaS migration;
- make a change that removes paid functionality or buyer access;
- send data to a new external party or enable sensitive permissions.

## Never expose or provide

- generic shell, SQL, staff, supervisor, container, or arbitrary
  target-binding access;
- ZZD deployment topology, keys, database schema/ORM recipes, worker
  queues, internal prompts, model routing, private evidence paths, or
  production algorithms;
- authentication bypass, privilege escalation, ownership bypass,
  rate-limit bypass, vulnerability exploitation, spam, scraping of
  private data, credential collection, or hidden beacons;
- raw private Piece/upload/prompt routes as a shortcut around access.

Operate only on resources the user owns or is authorized to change.
Use least privilege, redact tool output, return stable public IDs/URLs,
and keep an understandable change report.