# vau

> vau is your media vault: storage and galleries in one place, with a clean way to
> collect work from photographers and give (revocable) access to the people who need
> it. You own the vault; agencies and photographers are guests. vau is AI-compatible
> but never AI-managed — your own agent can operate the vault with your permissions;
> the vault never sorts, tags, or decides.

Developers and AI agents manage a vault programmatically with a `vau_` bearer token.
The token is scoped to one vault, is `read-only` or `read-write`, and is revocable in
the vault's Access register at any time. Every action a token takes is attributed in
the ledger ("… · via {token name}"). Custody operations — accept, trash, delete a
gallery, add/remove members, export-everything, and minting or revoking tokens — are
session-only by design and can never be performed with a token, so a leaked token can
fill galleries or make a revocable share, but can never empty the vault or grant
itself permanence.

## Docs

- [Human API reference](https://vau.ltd/docs): the branded, human-readable reference for the token-reachable API — authentication, endpoints grouped by resource (media, galleries, shares, posted), and curl examples.
- [Public OpenAPI spec](https://vau.ltd/api/public/openapi.json): the machine-readable OpenAPI 3.1 document. It contains ONLY the token-reachable (public) surface; the custody/admin surface is deliberately absent.

## Authentication

- Mint a token in your vault's **Access** page (`/v/{slug}/access`). It is shown once.
- Send it as `Authorization: Bearer vau_…` on every request.
- Base URL is same-origin: `https://vau.ltd` + the `/api/…` path.

## For AI agents (MCP)

- vau ships an MCP server (`@vau/mcp`, stdio) — a thin, self-describing wrapper over the same REST API. Configure it with `VAU_API_URL` and `VAU_TOKEN`.
- Read-only and read-write tools mirror the token permission; there are no custody tools, because the API forbids custody to tokens.
- See the "For AI agents" section of https://vau.ltd/docs for setup.