# Buba authentication

Last reviewed: November 5, 2026.

## Public information: no authentication required

The public integration exposes only product facts, public fictional adult character profiles, availability information, and published reference content.

- `GET https://mybuba.com/api/agent/info`
- `GET https://mybuba.com/api/agent/companions`
- `GET https://mybuba.com/api/agent/companions/{slug}`
- Public knowledge search at `https://mybuba.com/ask`
- Read-only MCP tools at `https://mybuba.com/mcp`

Do not attach credentials, identity tokens, session cookies, or private conversation text to these requests. Public tools do not gain account access when a visitor signs in.

## Private application: user sign-in required

The Buba interface uses Firebase Google sign-in or verified-email sign-in. The server verifies a recently issued Firebase identity token and verified email, then creates a session through the application's same-origin `/api/auth/session` exchange.

Production sessions use a Secure, HttpOnly, SameSite=Lax `__Host-buba_session` cookie with a five-day maximum age. The server checks session validity and account status. Protected resources require the signed-in account to own them. Private mutation requests also require the application's trusted Origin and its `X-Requested-With: Buba` header.

This describes the application's own authentication flow; it is not an agent credential or account-delegation interface. Users should sign in through Buba. Agents should not request, copy, export, or handle passwords, identity tokens, or session cookies in a conversation.

## Agent authorization

Buba does not provide agent API keys, an agent OAuth flow, or delegated private-account access. The public MCP server and public discovery endpoints cannot read private conversations, account companions, favorites, or generated images; they cannot send chat messages, modify accounts, or purchase plans.

Private APIs are not a public third-party integration contract. Do not attempt to bypass sign-in, ownership checks, application-origin checks, or service limits.

## References

- [Developer documentation](https://mybuba.com/docs)
- [Official product reference](https://mybuba.com/llm-info)
- [Privacy notice](https://mybuba.com/privacy)
- [Terms](https://mybuba.com/terms)
- [Availability and pricing](https://mybuba.com/pricing)