Capture access once
A successful browser or inbox create returns resource_access only on paid admission or its exact authenticated replay. Keep the resource identity, expiry, and opaque bearer in host-controlled secret state. Invocation reads and receipts deliberately omit the bearer, so there is no public recovery lookup if the host loses it.
- Send the bearer as Authorization: Bearer <capability> for HTTP lifecycle calls.
- For MCP lifecycle tools, attach the same header to the MCP transport request, never the tool arguments.
- Status, connect, wait, list, read, attachment access, and close or delete do not create another checkout.
Browser time is fixed
A browser session lasts 10, 30, or 60 minutes and cannot be extended. A new purchase creates a separate clean browser with new authority; no profile or browser state carries over.
Inbox time is renewable
An inbox starts with 1 hour, 24 hours, or 7 days. Before it expires, the extension runner can add any supported increment to the current expiry while preserving the same address, messages, read capability, and extension authority.
Each extension is a separately approved checkout. The expected expiry prevents concurrent renewals from losing already purchased time. Prepaid expiry may be at most 30 days ahead when an extension completes, but the inbox may be renewed indefinitely as time passes. Deleted and expired inboxes cannot be revived.
Terminal means terminal
Expiry ends active access immediately. Close and delete are idempotent, while provider or content cleanup may finish through bounded retries. An uncertain purchase is recovered with the same purchase identity; it is never recovered by buying another resource.