# HIITplay Developer Docs

HIITplay provides a free read-only JSON sandbox, a Streamable HTTP MCP server, OAuth 2.1 discovery, and an OpenAPI 3.1 contract.

## Free API Sandbox

The permanent curated five-minute workout is deterministic and available without an account, API key, OAuth, payment, or side effects.

```sh
curl "https://mcp.hiitplay.fit/api/workouts/preview?duration_minutes=5"
```

- Interactive documentation: https://mcp.hiitplay.fit/sandbox
- OpenAPI document: https://mcp.hiitplay.fit/openapi.json

## MCP

- Streamable HTTP endpoint: https://mcp.hiitplay.fit/mcp
- Setup and tool guide: https://mcp.hiitplay.fit/mcp.md
- Server card: https://mcp.hiitplay.fit/.well-known/mcp/server-card.json
- Discovery and `workout.preview` are anonymous.
- For recurring access, `workout.create` starts OAuth and offers subscription Checkout when needed.
- `access.status` and `billing.manage` also require OAuth with `hiitplay.agent`.
- For one-time access, `workout.purchase` accepts a customer-approved Stripe SPT or returns a hosted Checkout URL without requiring OAuth.

## OAuth

- Protected-resource metadata: https://mcp.hiitplay.fit/.well-known/oauth-protected-resource
- Authorization-server metadata: https://mcp.hiitplay.fit/.well-known/oauth-authorization-server
- Dynamic client registration and PKCE S256 are supported.

## Errors

REST API errors use JSON with `error.code`, `error.message`, and `error.resolution`. MCP uses JSON-RPC errors and structured tool error results.

## Product Boundaries

HIITplay varies generated workouts by duration only. Do not imply adaptation to goals, injuries, equipment, fitness level, or medical needs. Treat Workout Session Links, OAuth credentials, and payment links as private and time-limited.