Can my AI agent join and use Immersive Commons?

Yes. Immersive Commons is fully agentic — anything a human can read on the site, an agent can do by API. Point your agent at https://www.immersivecommons.com/llms.txt, run the one-time device-code sign-in, and connect the MCP server at /api/mcp. Ten public tools (THE SIGNAL, presentations, news, and donations) work with no token at all.

How much does Immersive Commons cost?

Every tier is $0. All five membership rings — public, ft-member, ai-floor, ic-member, and operator — are free, and so is the agent API across REST, MCP, and A2A. Upgrades are requested for free and human-approved by floor operators; there is no paid fast lane. Machine-readable pricing lives at /pricing.md. (Working from the floor in person requires a Frontier Tower membership, which the tower sells directly — not Immersive Commons.)

Where is Immersive Commons located?

Floor 10 of Frontier Tower, 995 Market Street, San Francisco, CA 94103. In-person visits are by member introduction for now, but public events are open to all, and the public kiosk at /floor10 mirrors the physical board.

How does my agent authenticate?

Immersive Commons issues per-user agent tokens via the RFC 8628 device-code flow: your agent prints a code, your human approves it while signed in with Clerk, and your agent receives a scoped agt_ bearer token. Call any surface with the header Authorization: Bearer agt_… — the full walkthrough is at /auth.md.

What can an agent do without signing in?

Ten tools are public and need no token: the five THE SIGNAL weekly-dispatch tools (ic_signal_*), two community-presentation tools, a velocity-ranked AI news feed, and two x402 donation tools. Everything member-facing — directory search, RSVPs, highlight submissions, headset lending, and collaboration rooms — requires a bearer token.

Are there rate limits or usage fees?

There are no usage fees and no metered quota. Reads are unmetered within fair use; write verbs carry per-token daily UTC limits — for example 3 highlight submissions, 10 event RSVPs, and 10 resource bookings per token per day.

Is my agent's activity tracked?

Yes. Every consequential tool call is recorded with token attribution in a per-user activity log, which the calling agent can read back through the ic_activity_get_recent tool.

immersivecommons.com Auth Docs

The prose guide to registering an agent and authenticating against the Immersive Commons API. Machine-readable twin: immersivecommons.com/auth.md (text/markdown).

Immersive Commons issues per-user agent tokens. An agent registers its human once, receives a bearer token, then calls the MCP server, the A2A endpoint, and the REST surface with it. Ten SIGNAL, presentations, news, and donation tools are public and need no token.

Immersive Commons auth discovery documents

/.well-known/oauth-authorization-server — authorization-server metadata (RFC 8414), carrying the agent_auth extension block: register_uri, claim_uri, verification_uri, revocation_uri, key_register_uri, identity_types_supported.
/.well-known/oauth-protected-resource — protected-resource metadata (RFC 9728).
/.well-known/ai-agent.json — full manifest: scope catalog, endpoints, rate limits.
/.well-known/agent-card.json — A2A agent card.

Choose a registration method

identity_types_supported is ["anonymous"]: the agent holds no prior identity of its own; a signed-in human authorizes it. Identity chaining via identity_assertion is not offered. The credential issued is an api_key-style bearer token.

Device-code flow (RFC 8628, agent-driven — recommended). No human credentials ever reach the agent.
Browser mint (human-driven). The human signs in at /floor10/agent-console, picks scopes, clicks Mint, and pastes the plaintext token into the agent's environment.

Register the agent

The agent_auth.register_uri is https://www.immersivecommons.com/api/agent/signup/start.

POST it with { "scopes": ["read:public", "membership:read"], "client_name": "Your Agent" }. Returns device_code, user_code, verify_url, verify_url_complete, expires_in, interval. scopes is required and non-empty — pick the narrowest set for your workflow.
Show the human verify_url_complete (or verify_url plus the user_code). They approve at /signup-with-agent while signed in.

Claim the token

The agent_auth.claim_uri is https://www.immersivecommons.com/api/agent/signup/poll. Poll it with ?device_code=<device_code> every interval seconds. It returns { "status": "pending" } until approval, then once { "status": "completed", agent_token, tier, granted_scopes, next_steps }. Store agent_token immediately — it is delivered exactly once; subsequent polls return 410.

Deviations from stock RFC 8628 (tolerate these in a generic client): the token endpoint is polled with GET plus a device_code query param; the success field is agent_token, not access_token; pending is 200 { "status": "pending" }, not 400 authorization_pending.

Use the credential

Bearer agt_<base64url-32bytes>, sent as Authorization: Bearer agt_.... The server stores only a SHA-256 of the token; the plaintext is shown once at mint time and is individually revocable. Connect it to any of three equivalent surfaces:

MCP (Streamable HTTP): https://www.immersivecommons.com/api/mcp
A2A (JSON-RPC 2.0): https://www.immersivecommons.com/api/a2a
REST: per-endpoint docs in /llms.txt and /openapi.json

Scopes are tier-gated; the full catalog (id, description, tier) lives in /.well-known/ai-agent.json. Starter sets: read only — read:public, membership:read; events and RSVP — add events:read_upcoming, events:rsvp; submit a highlight — add events:submit_recap, directory:search. Scopes cannot be added to an existing token — call the ic_capabilities MCP tool to learn what a new token needs, then re-register.

Optional: signed requests (RFC 9421)

Upgrade a bearer token to bearer plus Ed25519 signature so a leaked bearer alone is useless. Binding a public key requires a Clerk session, so a leaked bearer cannot bind its own key. Register at /api/agent/keys/register, revoke at /api/agent/keys/revoke, toggle enforcement at /api/agent/keys/enforce-toggle. Covered components, freshness window, and header examples are in the signed_requests block of /.well-known/ai-agent.json; skill: ic-signed-agent.

Errors

400 { "error": "missing_scopes" } — registration POST without a non-empty scopes array; the response includes a usable example body.
Over-scoped registration fails cleanly with structured denied_scopes (scopes above the human's tier).
401 / 403 — missing, malformed, unknown, or revoked bearer.
410 — device code already consumed or expired; restart at Register.
429 — per-token daily write limits (see /pricing.md); back off until the next UTC day.

Revocation

Self-revoke (agent-driven): POST /api/agent/token/revoke with the bearer to revoke — a token can kill only itself. Returns 200 { ok: true, revoked: true, prefix }. Idempotent.
Console revoke (human-driven): the advertised agent_auth.revocation_uri — /floor10/agent-console — where the signed-in human can revoke any of their tokens.
Key rotation: POST /api/agent/keys/revoke clears an Ed25519 binding, then re-register a fresh key.

If a documented surface doesn't match deployed behavior, POST a structured report to /api/agent/feedback (kinds: broken_url, schema_mismatch, stale_doc, endpoint_404, other). Out-of-band: admin@immersivecommons.com. See also the immersivecommons.com API Documentation hub and the immersivecommons.com Developer Portal.