Can an AI agent use Pinata?
As of 6 Oct 2026, an AI agent can't use Pinata on its own: Cloudflare Turnstile on the sign-up form.
- Find: Docs for agents: llms.txt, an OpenAPI and an MCP server.
- Access: Can't sign up.
- Use: Work not reached.
- Pay: Payment not reached.
- Leave: Leaving not reached.
To reach L2 · Gets in: let an agent sign up on its own.
With an account set up by a person: not measured yet.
What the levels meanDriven 6 Oct 2026Same level in 4 drives in a rowRules of 15 Oct 2026Claim this page
Written and checked by our agents from this drive's record. How we write.
Who gets in
- Agents on a serverTurned away when they send the sign-up form.
- Signed agentsThe sign-up page opens. The check on the form still applies.
- Agents in a person's browserNot measured yet.
Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from
What an agent can do in Pinata.
On its own
- Read all the product documentation automatically
- Download a publicly shared file without needing an account
- Discover a real pay-as-you-go option for uploading/downloading without an account (though paying it needs a cryptocurrency wallet the agent didn't have)
What it can't, and why
- Create an accountA visible human-verification puzzle appears on the sign-up form
- Upload, list, update, delete, or pin filesAll of these need an account key, and no account could be created
- Pay for account-free uploadsThe pay-per-use option needs a cryptocurrency wallet, which the agent did not have
Can an AI agent sign up for Pinata on its own?
No. Sign-up: needs a human. Web form only (Clerk-hosted at app.pinata.cloud/auth/signup). After Continue a visible Cloudflare Turnstile 'Verify you are human' replaces the form.
Does Pinata have an MCP server, and can an agent connect to it?
Yes. Pinata has an official MCP server.
A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 3 of our agent's 3 attempts worked.
What the drive found
APIOpenAPIMCP · officialCLIllms.txt–SandboxCan an AI agent pay for Pinata?
Payment not reached.
- MPP on its own domain
- Card checkout
It has a free plan.
What would let agents pay on their own
- List your plans on Stripe Projects. Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
- Sell the plan or credits over the rail, not only side endpoints. Let the paid call buy what the product sells, so the rail covers the whole product.
mpp.pinata.cloud answers 402 + WWW-Authenticate: Payment method="tempo" intent="charge" for account-free upload and download (listed first-party on mpp.dev). That buys side endpoints only, not the account plans; plans (Picnic $20/mo, Fiesta $100/mo) are paid by card on the web Billing page. Not paid: no wallet or card.
From the drive of 6 Oct 2026.
Not reached in this drive: the API key and deleting the account. Every checkpoint, in detail
For the team behind Pinata.
Where agents stop in Pinata today, and the fixes that get them further, highest impact first.
The fixes, highest impact first
- Let verified signed agents skip TurnstileStep-by-step guide
- Add a headless way to get an API keyStep-by-step guide
- Upgrade pinata-mcp to MCP (the 28 Jul 2026 spec)
1 more fix
- Return errors as RFC 9457 problem+json
- Claim it free and reply next to the result.
- A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
- Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Details
Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.
Already claimed it? Open it in your dashboard.
Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.
Embed the badge on your site
Behind the level.
Our agent couldn't get into Pinata, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.
Part scores · level history · paid plans
Part scores
Agent-ready setup
- llms.txt: found
- OpenAPI: found
- MCP server: found
- CLI: found
Not measured in this drive: Holds up, Docs match (part of an Audit).
Level history
- 1 Oct 20263 drivesL1Needs a person
- 6 Oct 2026L1Needs a person
Needs a paid plan
Not counted in the level.
| Capability | Plan |
|---|---|
| Private IPFS upload/retrieve | paid |
| Dedicated gateway with custom domain | paid |
For agents and builders.
The drive as data, every checkpoint and all 24 attempts.
How an agent connects · 4 tips
/api/tools/pinata.json/tools/pinata.mdMCP get_tool {"slug":"pinata"}
- Docs: start from https://docs.pinata.cloud/llms.txt; every page has a .md version, and the docs MCP at docs.pinata.cloud/mcp is 2026-07-28.
- Without an account you can still read public CIDs at https://gateway.pinata.cloud/ipfs/<cid>.
- With a wallet holding USDC on Tempo, mpp.pinata.cloud lets you upload (POST /v1/pin/public?fileSize=) and download without an account.
- Sign-up needs a human (Turnstile); once a human creates an admin JWT, pinata-mcp (35 tools) or the v3 REST API cover files, groups, signatures and pin-by-CID.
Every checkpoint, in detail · 9 checkpoints
- DocsHeadlessdocs.pinata.cloud/llms.txt (243 lines), .md pages and Accept: text/markdown all work headless; API reference per endpoint with scopes.
- Sign upNeeds a humanWeb form only (Clerk-hosted at app.pinata.cloud/auth/signup). After Continue a visible Cloudflare Turnstile 'Verify you are human' replaces the form.
- VerifyNot reachedNot reached: no account (sign-up stopped at Turnstile).
- KeyNot reachedAPI keys (JWT) are created only in the web app (Developers > API Keys); no account, so none. No OAuth/device flow or agent registration found.
- First callNot reachedAuthenticated calls return 401 without a JWT. Without an account, an agent can only read public CIDs through the public gateway (and via the MCP fetchFromGateway tool).
- First actionNot reachedNo upload possible: 401 on uploads.pinata.cloud/v3/files. The account-free MPP upload returns a real 402 that we could not pay (no wallet).
- PayNot reachedmpp.pinata.cloud answers 402 + WWW-Authenticate: Payment method="tempo" intent="charge" for account-free upload and download (listed first-party on mpp.dev). That buys side endpoints only, not the account plans; plans (Picnic $20/mo, Fiesta $100/mo) are paid by card on the web Billing page. Not paid: no wallet or card.
- CancelNot reachedNo plan was started. Billing docs describe plan changes only on the web Billing page.
- DeleteNot reachedNo account was created, so nothing to delete; the docs show no account-deletion route.
The attempt log · 24 attempts
| Capability | Route | Result | Evidence |
|---|---|---|---|
| Find docs: Fetch llms.txt and markdown docs | api | done ✓ | GET https://docs.pinata.cloud/llms.txt 200 text/plain, 243 lines; .md pages (quickstart.md, tools/mcp/overview.md) 200 |
| Pay the agent way: Probe 402 on mpp.pinata.cloud upload and download | api | partial ✓ | POST https://mpp.pinata.cloud/v1/pin/public?fileSize=1024 -> 402 application/problem+json, WWW-Authenticate: Payment realm="MPP Payment", method="tempo", intent="charge", request={"amount":"1000","currency":"0x20C0...8b50","methodDetails":{"chainId":4217}}; GET /v1/pin/public/{cid} -> same 402. mpp.dev/api/services lists pinata integration first-party. |
| Sign up: Look for a headless sign-up route (API/CLI/auth.md) | none | failed | Docs only link https://app.pinata.cloud/register (web form); CLI 'pinata auth' takes an existing JWT; /auth.md 404, api.pinata.cloud/.well-known/oauth-protected-resource 404 INVALID_ROUTE |
| Sign up: Submit the web sign-up form at app.pinata.cloud/auth/signup | browser | blocked | After Continue on the filled form (first/last name, email, password) the form is replaced by a visible Cloudflare Turnstile 'Verify you are human' widget (screenshot browser/shots/003.png). Sign-up form is Clerk-hosted. |
| Sign up: Hand the Turnstile step to a human (own browser) | browser | blocked | |
| MCP version: stdio pinata-mcp 0.2.0: server/discover then initialize offering 2026-07-28 | mcp | done ✓ | server/discover -> -32601 Method not found; initialize -> protocolVersion "2025-11-25", serverInfo Pinata 0.2.0; tools/list 35 tools |
| Docs MCP: POST server/discover on https://docs.pinata.cloud/mcp | mcp | done ✓ | 200 application/json result.supportedVersions ["2026-07-28"]; initialize answers 2025-11-25 over SSE |
| Cards: Probe server card, AI catalog, A2A card, agent skills | api | done ✓ | docs.pinata.cloud/.well-known/mcp/server-card.json 200 application/json (docs MCP); /.well-known/agent-card.json 200 application/json protocolVersion 0.3; /.well-known/agent-skills/index.json 200 (skill 'pinata'); ai-catalog.json 404 on pinata.cloud and docs; pinata.cloud/.well-known/agent-card.json 404 |
| AI preferences: robots.txt Content-Usage / Content-signal and headers | api | done ✓ | pinata.cloud/robots.txt: 'User-agent: * Allow: /' no preference lines; docs.pinata.cloud/robots.txt: 'Content-Signal: ai-train=yes, search=yes, ai-input=yes' (Cloudflare Content Signals, parses); no Content-Usage header |
| Markdown docs: Accept: text/markdown on docs page and .md URL | api | done ✓ | GET docs.pinata.cloud/quickstart with Accept: text/markdown -> content-type text/markdown, vary includes Accept; /quickstart.md 200 markdown |
| Get API credentials: Get a JWT without an account | none | blocked | API keys only from app.pinata.cloud/developers/api-keys after sign-in; unauthenticated GET api.pinata.cloud/v3/files/public -> 401 {"error":"ApiKeyID: cannot be blank; ApiSecret: cannot be blank; JWT: cannot be blank."} |
| Retrieve a file by CID through a gateway: Fetch a public CID (from Pinata's own docs) via MCP fetchFromGateway and via gateway.pinata.cloud | mcp | done ✓ | MCP fetchFromGateway cid bafkreicw5nrin7q2yrd2a34m4vav4tn6hkylgcu3kaitquervjtpa334m4 -> 'Fetched 72179 bytes from public IPFS, image/png'; GET https://gateway.pinata.cloud/ipfs/bafkreicw5nrin7q2yrd2a34m4vav4tn6hkylgcu3kaitquervjtpa334m4 -> 200 image/png 72179 bytes, x-ipfs-path matches |
| Upload a file to IPFS: Upload a file to IPFS with our account | api | blocked | POST https://uploads.pinata.cloud/v3/files -> 401 {"error":{"code":401,"message":"Not Authorized"}}; MCP testAuthentication -> 'Authentication failed: 401 Unauthorized' |
| List and query uploaded files: List and query uploaded files with our account | api | blocked | GET api.pinata.cloud/v3/files/public -> 401 'JWT: cannot be blank' |
| Update a file's name and metadata: Update a file's name and metadata with our account | api | blocked | needs a file and a JWT; no account |
| Delete a file: Delete a file with our account | api | blocked | needs a file and a JWT; no account |
| Pin an existing CID: Pin an existing CID with our account | api | blocked | POST /v3/files/public/pin_by_cid needs a JWT; no account |
| Create a group and add/remove files: Create a group and add/remove files with our account | api | blocked | POST /v3/groups/public needs a JWT; no account |
| Private IPFS upload/retrieve: Private network files | api | plan_gated | pinata.cloud pricing / capability map: private IPFS is a paid-plan feature; and no account |
| Dedicated gateway with custom domain: Create gateway + custom domain | api | plan_gated | capability map plan=paid; no account |
| Account-free upload via MPP: Upload hello.txt via mpp.pinata.cloud without an account | api | blocked | POST https://mpp.pinata.cloud/v1/pin/public?fileSize=1024 -> 402 application/problem+json, WWW-Authenticate: Payment realm="MPP Payment", method="tempo", intent="charge", request amount "1000" in token [redacted] on chainId 4217 |
| Cancel plan: Cancel a paid plan | none | skipped | No account and no plan started; billing docs: plan changes and cards only on the web Billing page ('Pinata currently only accepts standard debit and credit cards') |
| Delete account: Find a documented account-deletion route | none | blocked | No account was created; search of docs.pinata.cloud/llms-full.txt finds no account-deletion route |
| OpenAPI: Fetch the OpenAPI spec listed in llms.txt | api | done ✓ | GET https://docs.pinata.cloud/pinata-x402-api-v3.yaml 200 text/yaml, 'openapi: 3.0.0', title 'Pinata x402 Payment Instructions API' |
Also in File storage.
CloudinaryL4Gets in on its ownPinata vs Cloudinary
Backblaze B2L1Gets in on its ownPinata vs Backblaze B2
BoxL1Can't sign up on its ownPinata vs Box
DropboxL1Can't sign up on its ownPinata vs Dropbox