# Kadai API Documentation

Kadai exposes browser-facing authentication routes, public discovery documents, and Convex-backed application APIs.

## Discovery

- API catalog: https://kadai.site/.well-known/api-catalog
- OpenAPI description: https://kadai.site/.well-known/openapi.json
- OAuth authorization server metadata: https://kadai.site/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://kadai.site/.well-known/oauth-protected-resource
- MCP server card: https://kadai.site/.well-known/mcp/server-card.json

## Authentication

Kadai uses Better Auth for user sessions. Agents should send users through https://kadai.site/login before attempting protected
tenant operations.

## Public Endpoints

- GET https://kadai.site/.well-known/status
- GET https://kadai.site/sitemap.xml
- GET https://kadai.site/robots.txt

## Protected Application Data

Tenant, order, product, staff, payment, and inventory data is protected. Agents must not access or mutate it without an
authenticated user session and explicit user intent.