# Chatick — bridge for AI assistants

You are reading the connection guide for Chatick (team chat + project workspace:
tasks, files, documents, resources).

You are NOT connected yet. Connect first, then re-read the authenticated guide.

## Before you print a code: check your tool list

Look for a tool named `chatick_connect` in your own tool list. One look — no
command, no file to read. MCP tools are either there or they are not.

- Present → call it and stop reading here. It handles the desktop app and the
  code flow itself; where the app runs, the human just presses a button.
- Absent → the server is not configured in this session. Use the curl flow
  below and say so in one line, rather than asking the human whether MCP is
  available: they cannot see your tool list, and you can.

The steps here are for the second case only.

## How to connect (device flow — no secrets in chat history)

1. Request a code:

   curl -s -X POST https://api.chatick.com/x/device -H 'content-type: application/json' \
     -d '{"client":"Claude Code"}'

   Response: { "userCode": "ABCD-2345", "deviceCode": "...", "verifyUrl": "...", "expiresInSec": 600 }

2. Tell the human, verbatim:
   "Open {verifyUrl} and enter the code {userCode} to grant me access."
   Do NOT print deviceCode to the human — it is your secret.

3. Poll every 3 seconds until status changes (max ~10 min):

   curl -s -X POST https://api.chatick.com/x/device/poll -H 'content-type: application/json' \
     -d '{"deviceCode":"<deviceCode>"}'

   -> {"status":"pending"}   keep polling
   -> {"status":"denied"}    the human refused — stop and tell them
   -> {"status":"expired"}   start over from step 1
   -> {"status":"approved","token":"ck_...","user":{...},"project":{...}}

4. Keep the token in memory for this session only. Never write it to a file,
   never echo it back to the human, never commit it.

5. Read the authenticated guide — it lists every endpoint and your exact
   permissions:

   curl -s https://api.chatick.com/x/guide -H 'authorization: Bearer <token>'

## Notes

- The token dies when the tunnel is closed, after 24h, or after 12h idle.
  If a call returns 401, the tunnel is closed: start over from step 1.
- Every response carries "x-tunnel-expires-in" (seconds left) and
  "x-tunnel-expires-at". CHECK IT BEFORE STARTING ANYTHING MULTI-STEP. Dying
  halfway leaves the work half-done — a task created and its checklist
  rejected with 401 is worse than not starting: the human is left with a
  stub they did not ask for and have to clean up. If the remaining time
  looks short for what you are about to do, re-run the device flow first, or
  do the part that matters and tell the human what is left.
- Everything you do happens AS THE HUMAN who approved the code, limited to
  their permissions, and is recorded in the project history under their name.