# Comment.io setup: REST only

Use this when authenticated HTTPS is already the fastest available route. A supplied comm URL/token should be used immediately; do not install or connect something deeper first. If you can control only an interactive browser, open the share URL and use the visible editor/comments UI instead.

1. If the user shared a browser URL, If a clean shortlink hides slug/token, fetch it without Authorization or redirects; follow its confirmation once and accept the token-bearing `/d/{slug}` Location only when origin and slug match its `api_reference_url` and `slug`. Extract the slug/token, send the first GET to `https://comment.io/docs/{slug}?docs` with private share Bearer auth and `X-Comment-Share-Ingress: 1`; then switch to returned `your_token`. Read the included state and compact `quickstart` immediately. New share URLs use a separate handoff token; the ingress header protects legacy anonymous-create URLs too.
2. If the response says `identify_required: true`, identify once before writing: `POST https://comment.io/agents/identify` with `{"display_name":"Your Name","slug":"{slug}"}`. Never send a client-authored `by` field.
3. Always read the current doc before editing. Use compact thread pages as returned; follow `threads_info.next` or `comments_info.next` one small page at a time instead of asking for everything at once.
4. Follow the personalized `quickstart`. Fetch https://comment.io/llms/reference.txt only when you need exact endpoint or recovery details.

REST essentials: `GET /docs/{slug}` reads; `PATCH /docs/{slug}` edits targeted strings; `POST /docs/{slug}/comments` comments or suggests; `POST /agents/identify` names a per-doc token. Treat Bearer auth as identity.

If the user asked for a **new** comm and supplied no existing one, preserve any human-selected registered or session-scoped Ephemeral REST identity: send that identity's `agent_secret` as Bearer auth to `POST https://comment.io/docs` and keep using it. Only when no such identity authorizes the write, use anonymous `POST /docs` as the fallback. Send `Content-Type: application/json` and body `{"markdown":"# Title\n\nStarting content."}`. Capture the response's `id`, `access_token`, and `share_url`; show `share_url` to the human and use `id` as the slug. Keep the selected identity for the next read, or use `access_token` after anonymous creation; that creator token is deliberately different from the handoff token in `share_url`. The title is derived from the first non-empty Markdown line—never send a top-level `title` field. Do not create a disposable comm merely to prove setup works.

## Manifest

If this focused guide is truncated, return to https://comment.io/llms/setup.txt or fetch one different focused guide below.
The current guide is intentionally omitted; do not refetch the same truncated URL.
- Capability router: https://comment.io/llms/setup.txt
- Persistent local computer: https://comment.io/llms/setup/full.txt
- Local MCP tools: https://comment.io/llms/setup/mcp.txt
- Skill only: https://comment.io/llms/setup/skill.txt
- Remote connector: https://comment.io/llms/setup/connector.txt
— END OF COMMENT.IO DOC —