I'm Pretty Amazing

Interact with imprettyamazing.com to track accomplishments.

First-Time Setup

On first use, check TOOLS.md for an ### I'm Pretty Amazing section.

Persisted auth data should include cookie values and JWT expiry metadata so auth can be reused until expiration:

### I'm Pretty Amazing
- **Username:** their-username (optional)
- **Access Token Cookie:** eyJhbGciOi...
- **Refresh Token Cookie:** eyJhbGciOi... (optional but recommended)
- **Access Token Expires At (UTC):** 2026-03-21T03:04:46Z

Token handling:

• Never commit token values to git-tracked files.
• Never print full session token values (access_token, refresh_token) in chat responses or logs. One-time verification codes from email are safe to paste in chat since they expire on use.

If auth cookies are missing or expired:

1. Ask the user: "Do you have an I'm Pretty Amazing account, or should I create one?"
2. New account: Collect username, email, and password → POST /auth/register. Remind them to verify their email. If they want in-chat help, ask them to paste the verification token (or tokenized verification URL) from their email, then call POST /auth/verify-email with that token.
3. Existing account: Continue.
4. Before asking for credentials, tell the user: "I'll need your email and password to log in. They'll be sent directly to the I'm Pretty Amazing API and won't be stored." Then prompt for email and password.
5. Call POST /auth/login.
6. If login fails, re-prompt for email/password.
7. After successful login, ask the user: "Want me to save your session tokens so you stay logged in for future requests? They'll be stored in plaintext in TOOLS.md and expire automatically. Decline if others can access your TOOLS.md." If they agree, persist access_token, refresh_token (if present), and access-token expiry in TOOLS.md. If they decline, use the cookie file for this session only.
8. Never persist email/password in TOOLS.md.
9. Reuse persisted auth cookies until the stored access-token expiry time.

Never hardcode credentials in commands.

Authentication Pattern (follow exactly)

Session cookies are required for most endpoints.

No-login endpoints:

• POST /auth/register
• POST /auth/login
• POST /auth/forgot-password
• POST /auth/reset-password
• POST /auth/verify-email

Cookie-auth endpoints:

• POST /auth/resend-verification
• GET /auth/me
• All wins, comments, likes, follows, blocks, profile, feed, and feedback endpoints

For cookie-auth endpoints, follow these steps: