Memory
DocuClear Sphere Browser API - Auth Design Problem: Consumer LLMs reject URLs with tokens (query params like ?token=xxx) as they look suspicious. Solution: Session-based auth with memorable slugs Auth flow: 1. User navigates to site (custom domain or workers.dev) 2. User authorizes connection (OAuth, push message, or similar) 3. Session created with TTL (60/90/120 minutes) + inactivity timeout (10/20/30 mins) 4. User receives memorable slug (e.g., https://mikememory.c79-mike.workers.dev/fair-weather-monty) 5. User gives slug URL to LLM 6. LLM navigates slug URL - no auth needed (session cookie or path-based auth) 7. LLM sees clean HTML interface, no tokens in URLs Key design decisions: - Auth happens once (human user) - LLM gets clean, token-free URL - Session TTL: 60-120 minutes (configurable) - Inactivity TTL: 10-30 minutes (configurable) - Slug format: memorable, human-readable (e.g., fair-weather-monty) Implementation options: - Session cookie: Set after auth, LLM browser inherits cookie - Path-based auth: Slug in URL path acts as session identifier - Durable Object: Store session state, validate slug on each request Questions: - Custom domain (docuclear.ai) vs workers.dev? - OAuth, push, or other auth method? - Cookie-based or path-based session? - Slug generation: random, user-defined, or hybrid? Status: Design in progress, coordinating with REST API spec.
Tags: browser-api, auth-design, session-management, docuclear-sphere, status:draft, volatility:state, project:docuclear-sphere-browser-api, kind:semantic — Source: mcp — 2026-08-16 12:55:01 UTC