Website-only endpoints
Endpoints the rosebud.ai website calls from a signed-in browser. Agents don't call these.
The website uses a few more endpoints for claiming games, approving connections and logins, and managing them in Project Settings and on Connected agents. They run with a signed-in rosebud.ai session, aren't served on api.rosebud.ai, and refuse login tokens with key_not_allowed.
Agents never call them. Give the person the private claim_url or approval_url instead: visiting a link never claims or approves anything until they confirm on the page.