# OvenLovin

> The family recipe box your AI can actually use, and it knows who can't eat what.

Recipe box and meal planner for families and their AI agents.
Per-person allergen checks (US Big 9 + EU 14).
Not medical advice. Always check ingredient labels before serving.

Sign up or sign in at https://ovenlovin-demo.vercel.app/, open Settings, then API keys, create a key, and copy the `plaintext` value (shown once). Call `https://ovenlovin-demo.vercel.app/api/v1` with `Authorization: ApiKey rkapi_...` and connect MCP at `https://ovenlovin-demo.vercel.app/mcp`.

Just looking? The public demo at https://ovenlovin-demo.vercel.app issues a 24h sandbox key at /api/demo/enter?format=json.

## This site

- Home: https://ovenlovin-demo.vercel.app/
- Recipes: https://ovenlovin-demo.vercel.app/recipes
- Plans: https://ovenlovin-demo.vercel.app/plans
- List: https://ovenlovin-demo.vercel.app/list
- Settings: https://ovenlovin-demo.vercel.app/settings
- Docs: https://ovenlovin-demo.vercel.app/docs
- Connect your agent: https://ovenlovin-demo.vercel.app/docs/connect-your-agent
- MCP (Streamable HTTP): https://ovenlovin-demo.vercel.app/mcp
- REST: https://ovenlovin-demo.vercel.app/api/v1
- OpenAPI: https://ovenlovin-demo.vercel.app/api/v1/openapi.json

## Auth

Send one of:
- `Authorization: ApiKey rkapi_...`
- `Authorization: Bearer rkapi_...`
- `Authorization: Bearer <Clerk JWT>`

Clerk JWT MCP uses a kitchen you already belong to (open the app in the browser once). On MCP with a Clerk JWT, optional `X-Kitchen-Id` selects a kitchen you belong to. An API key is bound to one kitchen; a mismatched `X-Kitchen-Id` is `403`.
Unauthenticated REST returns problem+json 401.
A request outside an API key's scopes returns 403 problem+json (`<origin>/problems/forbidden`). Clerk sessions are not scope-checked. Keys created in Settings have full access. HEAD is treated as GET.
GET /api-keys, POST /api-keys, and DELETE /api-keys/{id} are session-only. An API key gets 401. POST and DELETE also require a signed-in admin or owner.
A malformed or foreign id on every [id] route is 404 (never 500, never another kitchen's data).
Unauthenticated MCP POST returns a JSON-RPC error envelope (HTTP 401). MCP scope denial is JSON-RPC -32003 with data.code "forbidden". MCP id fields and id arrays must be UUIDs.

## Example

curl -H "Authorization: ApiKey $KEY" "https://ovenlovin-demo.vercel.app/api/v1/recipes?limit=5"

## MCP tools

- whoami
- search_recipes
- get_recipe
- create_recipe
- import_recipe
- import_recipe_from_image
- delete_recipe
- get_household_context
- manage_household_schedule
- manage_household_settings
- manage_kitchen_invites
- manage_kitchen_members
- get_person_rules
- manage_people
- manage_person_rules
- manage_person_loves
- check_meal_plan
- export_shopping_list
- save_meal_plan
- get_meal_plan
- edit_meal_plan
- delete_meal_plan
- list_cookbooks
- get_cookbook
- manage_cookbook
- reorder_people

## REST

- GET /api/v1/health
- GET /api/v1/openapi.json
- GET /api/v1/status
- GET/POST /api/v1/recipes
- GET/PATCH/DELETE /api/v1/recipes/{id}
- GET/POST /api/v1/recipes/{id}/image
- POST /api/v1/recipes/{id}/restore
- POST /api/v1/recipes/import
- POST /api/v1/recipes/import/page
- POST /api/v1/recipes/import/photo
- GET/POST /api/v1/cookbooks
- GET/PATCH/DELETE /api/v1/cookbooks/{id}
- POST/DELETE /api/v1/cookbooks/{id}/recipes
- POST /api/v1/people/reorder
- GET/POST /api/v1/people/{id}/preferences
- GET/DELETE /api/v1/people/{id}/preferences/{prefId}
- POST /api/v1/uploads/images
- GET/POST /api/v1/people
- GET/PATCH/DELETE /api/v1/people/{id}
- GET/POST /api/v1/people/{id}/rules
- GET/PATCH/DELETE /api/v1/people/{id}/rules/{ruleId}
- GET/POST /api/v1/meal-plans
- GET/PATCH/DELETE /api/v1/meal-plans/{id}
- POST /api/v1/meal-plans/{id}/undo
- GET /api/v1/meal-plans/{id}/history
- GET/POST /api/v1/meal-plans/{id}/check
- GET /api/v1/meal-plans/{id}/shopping-list
- GET/PATCH /api/v1/meal-plans/{id}/shopping-list/state
- GET/PATCH /api/v1/households
- GET/PATCH /api/v1/households/settings
- GET/PUT /api/v1/households/schedule
- GET/POST /api/v1/api-keys
- DELETE /api/v1/api-keys/{id}
- GET /api/v1/households/mine
- POST /api/v1/households/select
- GET /api/v1/households/members
- PATCH/DELETE /api/v1/households/members/{userId}
- POST /api/v1/households/leave
- GET/POST /api/v1/households/invites
- DELETE /api/v1/households/invites/{id}
- GET /api/v1/invites/{token}
- POST /api/v1/invites/{token}/accept

GET /api/v1/meal-plans/{id}/check only reads. POST /api/v1/meal-plans/{id}/check saves the report on the plan.
There is no llms-full.txt; use /api/v1/openapi.json.

## Safety

Rule checking is deterministic and per-person. Findings name the person, rule, ingredient, and reason.
Incomplete checks return status: incomplete - never "no issues".
This is not medical advice. Always read labels.

## Full docs

- https://ovenlovin-demo.vercel.app/docs
- Quickstart: https://tbarho.github.io/ovenlovin/docs/quickstart/
- REST reference: https://tbarho.github.io/ovenlovin/docs/reference/api/
- MCP tools: https://tbarho.github.io/ovenlovin/docs/reference/
- Kitchen invites: https://tbarho.github.io/ovenlovin/docs/kitchen-invites/
- https://tbarho.github.io/ovenlovin/