create_account

holdings.proof/mcp-server · Verify this server

Create an account-bootstrap session for agent-driven onboarding. Public endpoint (no API key required). Returns a session id, channel-specific instructions, and — FOR TELEGRAM AND WHATSAPP ONLY — deep_link, qr_code (base64 PNG) and qr_text (UTF-8 text QR). The endpoint is safe to call regardless of whether the submitted identity is new: completing verification transparently creates a User when none exists, or logs the user in when one already does. The response is intentionally uniform — the server does NOT reveal whether the identity is already registered (this would be a user-enumeration oracle). If the agent needs to distinguish new-vs-returning users, call `get_current_user` after verification and inspect the user's `created_at`. EMAIL CHANNEL SENDS NOTHING HERE. The response carries email_sent=false and send_required=true: confirm with the user that the address is theirs, then call send_account_email. The other channels dispatch nothing either way — the user sends the first message themselves (reverse OTP). Agent usage: (1) Call create_account with the user's chosen channel. (2) For email, confirm with the user and call send_account_email. On telegram/whatsapp pass `deep_link` to render_auth_link, which prints the clickable link and a QR code beneath it. On sms `deep_link` is an EMPTY STRING and render_auth_link will reject it — show `sms_message`, which is what the user sends; this response carries no destination number, so do not invent one. Do not hand `qr_text` to a link renderer either — it is the link already rendered as QR art; print it verbatim inside a fenced code block if a real terminal needs the QR. (3) Call wait_for_account_creation with the session id until verification completes. (4) On verified, JWT + refresh cookies are set; proceed with whatever follow-up the agent was asked to do.