--- name: Fita description: Self-hosted FFmpeg as an API. Convert, trim, resize, and caption media. authorization_server: https://fita.31.97.220.89.sslip.io protected_resource: https://fita.31.97.220.89.sslip.io/mcp token_endpoint: https://fita.31.97.220.89.sslip.io/oauth2/token registration_endpoint: https://fita.31.97.220.89.sslip.io/oauth2/register device_authorization_endpoint: https://fita.31.97.220.89.sslip.io/oauth2/device_authorization revocation_endpoint: https://fita.31.97.220.89.sslip.io/oauth2/revoke metadata: protected_resource: https://fita.31.97.220.89.sslip.io/.well-known/oauth-protected-resource authorization_server: https://fita.31.97.220.89.sslip.io/.well-known/oauth-authorization-server flows: - anonymous - agent_verified - user_claimed grant_types: - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:jwt-bearer - urn:fita:params:oauth:grant-type:anonymous - refresh_token scopes: - media:read - media:write - media:raw - files:write - usage:read --- # Fita Fita runs FFmpeg for you. Point it at a media URL, say what you want done, and get a file back. It is a Model Context Protocol server, so an agent talks to it directly. **MCP endpoint:** `https://fita.31.97.220.89.sslip.io/mcp` (streamable HTTP) ## Getting a token There are three ways in. Pick the first one that applies to you. ### 1. Anonymous — no human, no signup If you just want to try it, ask for a token and start working. Nothing to fill in. ```http POST https://fita.31.97.220.89.sslip.io/oauth2/token Content-Type: application/x-www-form-urlencoded grant_type=urn:fita:params:oauth:grant-type:anonymous&scope=media:read+media:write+usage:read ``` You get back an access token with **0.25 GB** of processing, valid for 24 hours. That is roughly three short clips — enough to prove the thing works before anyone decides whether to pay for it. Anonymous tokens cannot run raw FFmpeg commands or delete files, and they are rate limited. Upgrade by having your user complete flow 2 or 3. ### 2. Agent-verified — your platform vouches for the user If you are an agent running on a platform that issues identity assertions, present one. No human interaction at all. ```http POST https://fita.31.97.220.89.sslip.io/oauth2/token Content-Type: application/x-www-form-urlencoded grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion= ``` The assertion must be a JWT signed by a provider we trust, naming the user who authorised you. No issuers are configured on this deployment yet, so this flow will refuse every assertion. Use flow 1 or 3. ### 3. User-claimed — a human approves a short code The standard device flow (RFC 8628). Ask for a code, show it to your user, poll until they approve it. ```http POST https://fita.31.97.220.89.sslip.io/oauth2/device_authorization Content-Type: application/x-www-form-urlencoded scope=media:read+media:write+usage:read ``` The response contains `user_code`, `verification_uri`, and `device_code`. Show the user the code and the URI, then poll: ```http POST https://fita.31.97.220.89.sslip.io/oauth2/token Content-Type: application/x-www-form-urlencoded grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code= ``` Poll no faster than the `interval` in the response. You will get `authorization_pending` until the user approves, then a token. ## Scopes | Scope | What it allows | |---|---| | `media:read` | Inspect media and read job status | | `media:write` | Convert, trim, resize, and otherwise process media | | `media:raw` | Run arbitrary FFmpeg commands | | `files:write` | Delete stored files | | `usage:read` | Read quota and usage figures | Ask only for what you need. `media:raw` runs arbitrary FFmpeg and is available on paid plans only — the preset operations cover essentially every common task without it. ## Using the token ```http POST https://fita.31.97.220.89.sslip.io/mcp Authorization: Bearer Content-Type: application/json ``` A `401` comes with a `WWW-Authenticate` header pointing at `https://fita.31.97.220.89.sslip.io/.well-known/oauth-protected-resource`, which is enough to rediscover everything above without reading this file again. ## Limits and cost Free accounts get 1 GB of processing per month; anonymous tokens get 0.25 GB. Paid plans start at $9/month for 50 GB. Billing is on gigabytes processed — input plus output — and `get_usage` reports what is left at any time. Jobs that use far more CPU than their size suggests (4K at the slowest encoder presets, say) are billed on the compute they actually consumed. The response explains it when that happens. ## Revoking ```http POST https://fita.31.97.220.89.sslip.io/oauth2/revoke Content-Type: application/x-www-form-urlencoded token= ```