Add Feedjolt (OAuth 2.1 MCP; REST public + own_account API keys)

[mllopart]

Contact: marc@feedjolt.com

Vendor listing for Feedjolt.

Auth (reviewers)

Main: OAuth 2.1 for Feedjolt MCP. Production is its own authorization server (DCR at /oauth/register, PKCE S256, protected-resource metadata at /.well-known/oauth-protected-resource/mcp). Agents Connect in the browser. JWT aud is https://api.feedjolt.com/mcp. Reader/writer are aliases of that resource.

MCP is not catalogued here — treg relays REST HTTP, not JSON-RPC. Sibling: https://www.feedjolt.com/en/feedback-mcp-server

Also: API keys (fjk_, Authorization: Bearer and X-API-Key) for workspace REST. That is what this listing uses for own_account. Probe GET /workspaces. Cookie-missing still Not authenticated. Garbage key 401 Invalid or revoked API key. Cross-workspace slug 403.

Catalogued (15 GETs, /api/v1)

6 public any_account (no key; test target corvidly):

endpoint	http
feedjolt.public.boards.list	200
feedjolt.public.posts.list	200
feedjolt.public.posts.get	200
feedjolt.public.posts.search	200
feedjolt.public.roadmap.get	200
feedjolt.public.changelog.list	200

9 own_account (API key; test slug luodaint must match the key):

endpoint	http
feedjolt.account.workspaces.list (probe)	200
feedjolt.boards.list	200
feedjolt.posts.list	200
feedjolt.posts.search	200
feedjolt.posts.get	200
feedjolt.roadmap.get	200
feedjolt.changelog.list	200
feedjolt.statuses.list	200
feedjolt.tags.list	200

Do not catalogue /api-keys, billing, jwt-config, writes, or MCP.

Key provider: src/treg/oauth_feedjolt.py sidecar (auth_kind=key for this REST listing; MCP OAuth 2.1 is separate). platform_key_feedjolt / TREG_PLATFORM_KEY_FEEDJOLT. Logo is the production FeedjoltMark.

No merge from us. No credentials in the diff.

[mllopart]

Follow-up after comparing this listing against luodaint/feedjolt (development) and live https://api.feedjolt.com/openapi.json.

Cut: public-only. The 6 any_account public GETs stay. The 9 own_account tools and the key probe are gone.

Workspace REST is cookie-session, not API-key:

• GET /workspaces is list_workspaces(current_user: CurrentUser). CurrentUser reads the access_token cookie. A valid fjk_ key 401s the same as a garbage one (Not authenticated). That is not a key probe.
• Workspace-scoped REST GETs (boards/posts/roadmap/changelog/statuses/tags) use WsContext → CurrentUser, not APIKeyContext.
• get_api_key_context exists (X-API-Key only) and is unused by any REST route. verify_key is only called from that unused dep and from MCP auth.
• Docs promise Authorization: Bearer fjk_. OpenAPI lists X-API-Key + CookieAuth. MCP accepts both Bearer and X-API-Key. REST does not.

MCP stays out of the catalog (treg relays REST HTTP, not JSON-RPC).

Still in this PR

• 6 public tools, live 200s on corvidly (see original ledger).
• Official FeedjoltMark SVG (not a lettermark).
• Empty platform_key_feedjolt / TREG_PLATFORM_KEY_FEEDJOLT leftovers in config.py / render.yaml — unused now; can drop on merge.
• tests/test_oauth_providers_m3.py still names feedjolt in test_every_provider_is_registered. Drop that string (it is no longer a key provider). tests/test_key_providers.py is already updated.

Authenticated REST belongs in a later PR after Feedjolt wires cookie+key onto those routes. Contact: marc@feedjolt.com.