Xiaoya Open Platform documentation
These documents explain how a third-party agent or enterprise application uses OAuth 2.0 to access a Personal or Team context, invoke available models, and settle business usage with Xiaoya points.
Documentation index
- Quickstart: registration, code exchange, model discovery, and the first model call.
- OAuth 2.0: authorization, token exchange and revocation, scopes, lifecycle, and server security.
- Points and billing: balance, charge, refund, usage, and Personal/Team curl and Node.js examples.
- Model catalog and calls: discover real available models and use the model gateway.
- XiaoyaHub live APIs: browse enabled TikHub and MiniMax H3 operations with their current point costs.
- Team context: Team tokens, member quota, workflow headers, and the current non-streaming constraint.
- Agent development rules: MCP/web agents, schemas, callbacks, artifacts, and review.
- Complete API reference: parameters, bodies, and response schemas for every external operation.
- Install the developer Skill: download offline templates, validators, and API contracts.
- AI-readable documentation:
llms.txt, full context, and OpenAPI entry points.
API boundary
The public contract covers OAuth, Personal and Team APIs, the model gateway, runtime assets, execution grants, sandbox runtime, and MCP callbacks/introspection. Admin, desktop-internal, and private website BFF routes are not developer APIs.
OAuth access tokens, client secrets, authorization codes, and Team workflow context belong only on trusted servers. Never place them in browser storage, AI prompts, URLs, or logs.