# Hyperwave authentication

## Discover

Hyperwave's public agent API, documentation MCP server, and calculation MCP server are free and anonymous. Read [the OpenAPI specification](https://www.hyperwave.app/openapi.json) and [developer documentation](https://www.hyperwave.app/docs/developers). No API key, account, registration, or payment is needed for these public tools.

## Pick a method

Call the documented public endpoints directly over HTTPS. Connect an MCP client using Streamable HTTP at https://www.hyperwave.app/mcp for calculations and export targets, or https://www.hyperwave.app/mcp/docs for documentation. The documentation tools have no project access. Product session tools access only the temporary workspace identified by its private token; they have no account-library scopes.

## Accounts and credentials

The browser editor at [Open Hyperwave](https://www.hyperwave.app/app) works without signing in. Account and cloud features use a separate browser session. That session is not an OAuth authorization server or an agent credential. create_session issues a secret scoped only to its temporary workspace. Pass it in session tool arguments. It is separate from account sessions; Hyperwave does not accept agent identity assertions or offer an account identity exchange. OAuth protected-resource metadata is therefore not published for these anonymous services.

## Make a request

Send a JSON request directly to the public endpoint:

```sh
curl https://www.hyperwave.app/api/v1/agent/calculate_frame_size \
  -H 'Content-Type: application/json' \
  -d '{"samplesPerFrame":2048,"frameCount":256,"sampleRate":48000}'
```

A successful response is HTTP 200 with totalSampleCount, fileByteCountWithHeader, and totalDurationSeconds. Send the request without an Authorization header or browser cookies. The calculation saves no project data.

## Errors

The public REST API returns JSON errors with a code, message, and hint. A 400 means the input is invalid, 404 means the operation or public document is unknown, and 413 means the request is too large. Correct the request using the OpenAPI schema. MCP uses the protocol's error responses. These endpoints never need your password or a session cookie.

## Revocation

close_session revokes a temporary workspace and its token by deleting the session. Save a preset first. Sessions also expire after 24 hours. Disconnect an MCP server in your client to stop using it. Manage browser account sessions separately in the account dashboard.