Workspace#

The operational tools for the owner's team: sign-in codes relay, AI task queue, Canvas device login, the sandboxed worker and the admin pages. Every page here requires a browser login.

Transcription web app#

/app/ — login required (approved account).

The single-page web UI for Whisper transcription: upload or paste a URL, pick an output mode (transcribe, srt, perfect-srt, bilingual-srt, translated-srt, …), watch the job progress and download the result. Audio is extracted in the browser with ffmpeg.wasm, which has a memory ceiling of about 2 GB; extract audio locally with ffmpeg first for very large videos. History is kept per browser and, when signed in, per user.

Sign-in codes relay#

/signin-codes — login required (approved users, filtered to the services they are granted).

Watches shared-account mailboxes over IMAP and shows the latest login OTP or magic link on an auth-gated board, so each approved person can grab their own code without access to the mailbox. Extraction is regex-first with false-positive guards.

/admin/otp — admin only. Manage inboxes and services, grant per-user access, and test a mailbox connection. New inboxes are added from this page. A failure in the relay never breaks transcription.

AI task queue#

/tasks — login required.

An approve-then-run board. Approved users submit a task for a project; the owner reviews and approves it; a headless coding agent then runs it per project. Nothing runs without approval.

/admin/tasks — admin only. Approve, watch and manage queued tasks.

Canvas device login#

Canvas is the desktop editor that connects an AI through MCP. It signs in with an approved-account device flow, not an API key. Summary of the protocol (full detail in the repository's docs/CANVAS-AUTH.md):

1. The client generates a random verifier and sends its SHA-256 as challenge to POST /api/canvas/devices/start, receiving {device_code, user_code, verification_uri, expires_in: 600, interval: 3}.
2. The person opens /api/canvas/devices/verify in the browser (login required), enters the code and explicitly presses Approve this device. Completing Google login alone approves nothing.
3. The client polls POST /api/canvas/devices/poll with {device_code, verifier} every 3 seconds until {status: "approved", refresh_token, access_token, expires_in: 60, account}.
4. The 30-day refresh token goes in the OS credential store; POST /api/canvas/refresh returns new 60-second access tokens. GET /api/canvas/session and POST /api/canvas/logout complete the set.

Only current accounts with role user or admin and not suspended qualify. API keys never authorize these endpoints; a Canvas token is refused everywhere else. Bodies are limited to 4096 bytes; codes and tokens never go in URLs. Rate limits: start 30/min, poll 300/min, verification 20/min, refresh 120/min, one poll per device per 3 s.

The public Canvas AI guide and exact tool schemas are served at /app/canvas/ai-guide.html, /app/canvas/ai-guide.md and /app/canvas/mcp-tools.json.

Sandboxed worker (API)#

POST /api/ai/worker, GET /api/ai/worker/jobs/{job_id}, POST /api/ai/worker/jobs/{job_id}/cancel, GET /api/ai/worker/profiles — API key or approved login, always; no local-network bypass. Default-deny: a custom key can use only the profiles in its worker_profiles capability.

curl -sS https://maximind.dev/api/ai/worker \
  -H "x-api-key: $MAXIMIND_API_KEY" -H 'content-type: application/json' \
  -d '{"profile":"research","brief":"Find the current official Python documentation homepage and cite the source.","effort":"low","timeout":180}'

{"ok": true, "job_id": "opaque-id", "status": "queued"}

Results carry text, optional artifacts and a receipt (profile, tools_used, denied, paths_outside_workspace, origins_visited, isolation, gate_verified). Brief limit 32,000 characters; read_docs inputs follow the attachment limits in Vision; 8 admitted jobs per key per day; default model timeout 900 s, hard cap 1,800 s. Expect 90 to 110 seconds minimum for a one-tool cold job. Answers or artifacts containing secret-shaped values are denied. The admin kill switch is POST /api/admin/worker/settings with {"enabled": false}.

Admin pages#

All admin pages require an admin browser session or the Primary Key. Custom API keys can never call /admin/*.

curl -s https://maximind.dev/admin/usage -H "x-api-key: $PRIMARY_KEY"

{"ok": true, "by_actor": [{"actor": "API: Primary Key", "actor_type": "api_key", "requests": 5, "credits": 13, "last_seen": 1782563285.4}],
 "by_endpoint": [{"endpoint": "web_scrape", "requests": 1, "credits": 1}],
 "last_30_days": [{"actor": "API: Primary Key", "requests": 5, "credits": 13}],
 "total_requests": 7, "total_credits": 23,
 "credit_costs": {"transcript_native": 1, "transcript_generated_per_min": 2, "video": 1, "channel": 1, "playlist": 1, "web_scrape": 1, "chat": 1, "image": 5, "tts": 1, "translate_per_min": 30, "file_transcribe_per_min": 2}}

User pages#