Galley Render

Get a link to the Stripe customer portal, for a human to open: change plan, update the card, download invoices, or cancel. This is the only way any of those happen. Galley's API cannot change or cancel a subscription and cannot issue a refund — deliberately — so if you are asked to downgrade or cancel, the answer is this link and a human on the other end of it. The link is single-use and short-lived, so fetch a fresh one rather than storing it. Only works once the account has subscribed at least once; before that, use `upgrade`. Free. **If billing is not enabled on the deployment this is pointed at, the call is refused with `billing_unavailable` (503) rather than answered with a link.** Say so and point the human at support@galleyrender.com. Do not construct a portal URL yourself and do not retry.

Turn the keyless trial into a real account and get a permanent API key. Call it once with an email: a verification link is sent and the tool returns `status: "pending_verification"`. After the human clicks the link, call it again with the same email and it returns the API key, once. The key is not released before the click. The click also binds this client to the new account, so a connector that cannot send headers is connected from then on without anything further. **If that address already has an account, no second one is made.** You get `status: "existing_account"`, `verified: false`, `existing_account: true`, and a one-time code in the post — hand that code to `link_account` and this client is connected to the account that already exists. Use this rather than inventing a second address: two accounts means two free tiers and two sets of templates, and the renders anyone is waiting for are on the first one. The trial in this session is upgraded in place, so templates and renders made during the trial are kept. The free tier is 20 renders a month; pricing beyond that is at https://galleyrender.com/pricing. Store the key as a secret — it is shown only on that one call.

Create a new template at version 1 from an HTML document with Liquid expressions, plus a JSON Schema for its data. Use this when nothing in list_templates fits. The name must be free on this account — publishing a change to an existing template is `update_template`, not this. Free.

Fetch a render by id: its status, and a freshly signed URL once it has succeeded. Use it to poll a queued render, or to re-sign a URL that has expired — signed URLs are short-lived, the stored object is not. Free, and never re-renders.

Fetch one template version: its JSON Schema, its default render options, an example payload and its HTML source. Read the schema before rendering — it is the contract for the `data` argument. Free.

Point this MCP client at an account you already have, so header-less calls from it stop spending the keyless trial. **This is for clients that cannot set HTTP headers** — Claude.ai custom connectors and ChatGPT apps. If your client *can* set a header, prefer that: it is per-connection, it is not tied to a network address, and it needs no tool call at all. Two ways to prove the account is yours. `api_key`, if you have the key to hand. Or `link_code`, the one-time code mailed to the account's own address — call `create_account` with that address to have one sent, and nobody has to paste a key into a chat window. Either way the credential is used once, checked, and dropped: what is stored is the account id and a key minted for this client, which `unlink_account` revokes. **The client id is coarse.** Without an `X-Galley-Client-Id` header it is derived from the IP address and the User-Agent, so on a shared machine, or behind one office NAT with the same client, another person can land on the same identity and reach this account. Use a header instead wherever the client allows one, and `unlink_account` when you are done on a machine that is not yours. Free.

Recent renders on this account, newest first, with status, template version and a signed URL for each that succeeded. Useful for finding a render whose id you lost, or checking what a batch did. Free.

List the templates on this account, with their latest version number. Start here: rendering needs a template, and this says which ones exist. A brand-new trial account starts with the starter library (invoice, quote, receipt, og-card, certificate and more) already loaded. Free.

Render a template plus a JSON payload into a PDF, PNG or JPG and return a signed URL. This is the one tool most calls need. Small jobs finish inside the call and come back `status: "succeeded"` with a `url` you can hand straight to a user. Anything with a `webhook_url`, `async: true` or a large payload comes back `status: "queued"` with an id for get_render. Renders are deterministic and cached: the same template version, data and options return the stored object with `cached: true`, free and instant. Billing is one unit per PNG or JPG and one per PDF page; cache hits are never billed. No API key needed to start — the first call mints a 10-render trial and returns its token.

Undo `link_account`. The binding is deleted and the key that was minted for this client is revoked, so the client can no longer reach the account. Your own API key is untouched — this disconnects a client, it does not close an account. Do this on any machine that is not yours, and on any client whose identity is a shared one (no `X-Galley-Client-Id` header means IP plus User-Agent). Calls afterwards fall back to the keyless trial. Safe to call when nothing is linked. Free.

Publish a new immutable version of an existing template. Versions are never edited in place: `invoice@2` keeps rendering exactly as it did, and anything pinned to it is unaffected. Renders cached against the old version stay valid, and the new version starts with a cold cache. `engine`, `schema`, `options` and `example` are inherited from the previous version unless you send them, so a source-only change needs only `template` and `source`. Free.

Get a Stripe Checkout link for a paid plan, for a human to open. **This tool cannot subscribe anybody.** It returns a `url`; a person has to open it and enter a card on Stripe's own page. Hand the URL to the human you are working for and say what it costs. Nothing is charged, and no plan changes, until they finish on that page — at which point Stripe tells Galley and the new plan is live within a second or two. Confirm with `usage`. Use it when a render was refused with `quota_exceeded`, or with `plan_required` because the account is on Free and asked for webhooks or cloud delivery. The error body names the plan that would have worked. The account needs a verified email address first — invoices and receipts go to it — so call `create_account` before this if you are on the keyless trial. Changing or cancelling an existing plan is `billing_portal`, never this. Free. **If billing is not enabled on the deployment this is pointed at, the call is refused with `billing_unavailable` (503) rather than answered with a link.** That is deliberate: the alternative is a URL on a domain that does not resolve, which you cannot tell apart from a real one. On that error, say so and point the human at https://galleyrender.com/pricing. Do not construct a checkout URL yourself and do not retry.

What this account has spent this period and what is left: renders, billable units by format, cost, the free-tier allowance, the monthly spend cap and — on a keyless trial — how many of the 50 trial renders remain. Check it before a large batch. Free.

Dry-run a `data` payload against a template's JSON Schema and get back exactly the errors a render would raise — field path, expected type, what was received and a value that would be accepted. Costs nothing and renders nothing. Use it before a batch, or whenever you are assembling a payload from somewhere you do not control.

The account this connection is acting on: its id, its plan, how many renders are left, and — the part no other tool answers — **how this request authenticated**: `header` (a key on the HTTP connection), `binding` (this client was linked with `link_account`), or `trial` (the keyless ten-render trial). Call it before a batch, and call it the moment anything about quota surprises you. A `quota_exceeded` that quotes a limit you do not recognise almost always means `trial`: the key never reached this server, and the renders are coming out of a throwaway account rather than yours. Free, and it renders nothing.