Sign in
guest

Open Guest Workspace

Mint one workspace for one stranger — NEVER ANY MORE.

Owner, 2026-09-25, after ~$5k went through our model key: "NO GUEST PLAY AT ALL … every person must sign in for real before ANY product use". The attacker minted 22 guest workspaces here (Turnstile unconfigured, the cap keyed on a spoofable header), each an owner with every capability. So the door refuses whatever the environment says, before it reads anything; the body below stays only until the guest machinery is taken out whole.

post/v1/guest/workspace

Request body

namestring
originstring
turnstile_tokenstring
analytics_session_idstring uuid nullable
samplestring
door_variantstring nullable
door_wordsstring nullable

Response

Successful Response

object required

Changes

Changed in 4 of the 32 revisions of this API.14

Of the 32 revisions, 1 has no diff computed.