# AX Check: timely.com Checked 2026-09-19. Timely's pricing and quickstart are clear and openly stated. Starter $11, Premium $20, Unlimited $28 per user/month are listed openly, and onboarding gives concrete role-based setup steps. No MCP or CLI docs found. ## Onboarding needs a login ## Coding sessions All three independent sessions (DeepSeek V4 Pro, Kimi K3, Qwen 3.8 Max) completed the task and produced full pricing tables covering Starter, Premium, and Unlimited tiers, each noting assumptions like per-user monthly billing, annual discounts, and plan caps sourced directly from timely.com's pricing page. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/67861388-176f-4a17-a1aa-3afc657bde7e) · [Read transcript](https://www.ax-check.com/timely.com/sessions/deepseek.json) Final output gives a full pricing table (Starter $11/$9, Premium $20/$16, Unlimited $28/$22) with explicit assumptions: per-user/month, monthly vs yearly billing, plan-based user/project caps, and 14-day trial, sourced live from timely.com/pricing (seq 37-41). Session findings unavailable. ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/d9043a12-4657-4ab0-96e3-9e15b16a4c0f) · [Read transcript](https://www.ax-check.com/timely.com/sessions/kimi.json) Final output lists Starter/Premium/Unlimited tier prices with explicit assumptions (monthly vs yearly billing, per-user, API access gated to Unlimited tier, 14-day trial), sourced from timelyapp.com/pricing (seq 28). #### End-to-end onboarding - **Onboarding needs a login**: The agent found a real hosted API (api.timelyapp.com) and a real OpenAPI doc site (dev.timelyapp.com), but never obtained genuine credentials. It only tested the script with a placeholder token 'invalid-test', which correctly returned 401 Unauthorized. No account signup, no OAuth app creation, and no valid access token were produced in-session, and the agent explicitly states it needs a human to create a trial account and hand over a token. Event 50: ```text Auth failed (401): {'error': 'Unauthorized'} ``` Event 52: ```text getting a token requires signing up for a trial (email verification through a web UI) and then manually creating an OAuth app in the Timely settings as an admin ``` Event 39: ```text account = accounts[0] account_id = account["id"] ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **OAuth-only auth requires human sign-up and admin console access**: Timely's API supports only OAuth 2.0 authorization-code flow (no API keys or personal access tokens, confirmed by inspecting the OpenAPI spec). Getting a usable token requires a human to sign up for a trial account, verify email, and manually create an OAuth application in the account admin settings. This is normal product security design, not a defect, but it fully stopped autonomous end-to-end testing. Event 35: ```text password -> 1 personal_access -> 0 grant_type -> 2 api_key -> 0 sandbox -> 0 ``` Event 52: ```text OAuth 2.0 authorization-code is the **only** auth method (no personal access tokens or API keys), so token bootstrap/refresh needs a human in the loop; there's **no sandbox environment** ``` - **Cloudflare blocked default scripted user-agent**: The API's Cloudflare protection rejected the default Python urllib user-agent with a 403 'browser_signature_banned' error before the agent set a custom User-Agent header. This was a test-environment/agent-tooling issue that the agent diagnosed and fixed itself within the same turn, so it did not remain a blocker. Event 43: ```text Auth failed (403): {'type': 'https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1010/', 'title': 'Error 1010: Access denied', 'status': 403, 'detail': "The site owner has blocked access based on your browser's signature." ``` #### Suggested Changes - **Add a note about default HTTP client user-agents to the API auth docs**: On dev.timelyapp.com's authentication section, add a callout that Cloudflare blocks default scripted user-agents (e.g., bare Python urllib, curl without custom UA) and that developers should set a custom User-Agent header on requests. Verify by testing a fresh script with an unmodified default urllib/requests user-agent against api.timelyapp.com and confirming it no longer returns the Error 1010 access-denied response. Event 43: ```text 'error_name': 'browser_signature_banned', 'error_category': 'access_denied' ``` - **Offer a lightweight token option (personal access token or sandbox) for API trial evaluation**: Because the API only supports OAuth 2.0 authorization-code flow, evaluators without an existing admin account cannot obtain a token without manual browser sign-up and OAuth app creation. Consider adding a personal access token option or a sandbox/test account for the trial plan, verifiable by confirming a developer can call GET /1.1/accounts successfully within minutes of signing up, without configuring an OAuth application. Event 24: ```text This API uses OAuth 2.0 for authentication. ### OAuth 2.0 Authorization Code Flow ``` Event 52: ```text getting a token requires signing up for a trial (email verification through a web UI) and then manually creating an OAuth app in the Timely settings as an admin ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/c19b79b8-cd6e-4439-b1e7-b3cbcfe8e0a9) · [Read transcript](https://www.ax-check.com/timely.com/sessions/qwen.json) README.md pricing table lists per-user/month figures with explicit assumptions (plan tier, monthly vs annual billing, user/project caps, source and check date 'timely.com/pricing, checked today'). #### End-to-end onboarding - **End-to-end onboarding not demonstrated**: The agent never obtained real OAuth credentials. It only tested the client against api.timelyapp.com with a hardcoded placeholder token ('bogus') and account_id=1, which correctly returned 401 Unauthorized. The agent explicitly stated it could not create the OAuth application because that requires human admin login at app.timelyapp.com, and asked the product owner to supply TIMELY_ACCESS_TOKEN. No authenticated operation against the real product was ever demonstrated. Event 102: ```text API error: GET /1.1/1/users/current -> HTTP 401: {"error":"Unauthorized"} ``` Event 112: ```text The only thing I can't do without you is authenticate: creating the OAuth app at `app.timelyapp.com/{account_id}/oauth_applications` requires an admin login in the web app. ``` Event 92: ```text Set TIMELY_ACCESS_TOKEN. See README.md for the OAuth setup steps. exit=1 ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **OAuth application creation requires admin login in the Timely web app**: Per the OpenAPI docs, obtaining an OAuth client_id/secret requires visiting app.timelyapp.com/{account_id}/oauth_applications with admin access. This is a normal login requirement (not a product defect) that the agent correctly identified it could not complete itself, so it stopped short of any authenticated API call and asked the product owner to supply a token. Event 52: ```text 1. **Create an OAuth Application**: Go to `https://app.timelyapp.com/{account_id}/oauth_applications` (admin access required) ``` Event 112: ```text The only thing I can't do without you is authenticate: creating the OAuth app at `app.timelyapp.com/{account_id}/oauth_applications` requires an admin login in the web app. ``` - **Cloudflare blocked default Python User-Agent on api.timelyapp.com**: A test request using Python urllib's default user agent was rejected by Cloudflare's bot protection with a 403 'browser_signature_banned' error. This is test-environment/agent-tooling friction rather than a Timely product defect, and the agent resolved it itself by setting a custom User-Agent header. Event 92: ```text "title":"Error 1010: Access denied","status":403,"detail":"The site owner has blocked access based on your browser's signature." ``` #### Suggested Changes - **Add a GET /1.1/accounts endpoint to the OpenAPI spec**: The API description text tells developers to 'call GET /1.1/accounts after authentication' to discover workspace IDs, but this path does not appear anywhere in the published OpenAPI paths list (only /tic/1.1/user_accounts is present, also undocumented). Add the endpoint to the spec at developer.timely.com so client code generated from the spec does not have to guess between two undocumented account-discovery paths. Event 52: ```text To get your account IDs, call `GET /1.1/accounts` after authentication. ``` Event 68: ```text ['/tic/1.1/user_accounts'] ``` ### Task given to each agent Help me build a simple example using Timely. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: B · 82/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Failed** — Homepage answers Markdown requests ```text Homepage returned text/html even when text/markdown was requested; no Markdown representation offered. ``` - **Failed** — llms.txt mentions offered API, MCP, and skills ```text llms.txt omits the API docs (developer.timely.com) linked from the homepage; no MCP or skills mentioned. ``` - **Pass** — llms.txt provides an actionable documentation index ```text llms.txt returns 200 with organized Product, Features, Resources, Compare, Legal, Company sections linking canonical docs. ``` - **Pass** — llms.txt provides navigation guidance ```text llms.txt groups links under clear headings with descriptive summaries, giving usable navigation guidance. ``` - **Pass** — A compact guide representation exists ```text llms.txt returns 200 with organized Product, Features, Resources, Compare, Legal sections. ``` - **Pass** — A focused guide is directly retrievable ```text Quick-start onboarding page fetched 200 with role-based concrete steps and links. ``` - **Pass** — Equivalent instructions fit a token budget ```text Quick-start guide measured 7027-9329 tokens, within the 8000-token budget. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats cannot be measured. ``` - **Pass** — The compact guide is independently actionable ```text Quick start onboarding gives role-based steps: activate account, install Memory app, connect calendars, submit timesheets. ``` - **Pass** — Install and next-step links resolve ```text Fetched quick-start and install pages returned HTTP 200; onboarding links resolve to live handbook pages. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text Quick start onboarding gives role-based first steps: activate account, install Memory, connect calendars, submit time. ``` - **Pass** — Installation commands are extractable ```text Install page gives concrete steps: open Safari to app.timelyapp.com, File → Add to Dock. ``` - **Pass** — Code examples are available without interaction ```text Install guide shows inline URLs and step-by-step instructions without requiring interaction. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text Onboarding states Plans: All, Permissions: Everyone, and requires signing in to your workspace. ``` ### Pricing - **Pass** — Pricing is readable without interaction ```text Pricing page renders plan names, per-user prices and limits directly in HTML. ``` - **Pass** — Prices are stated, not gated ```text Starter $11, Premium $20, Unlimited $28 per user/month stated openly. ``` - **Pass** — Pricing units and limits are explicit ```text Plans list per user per month, project counts and user caps explicitly. ``` - **Pass** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4 Pro: Final output gives a full pricing table (Starter $11/$9, Premium $20/$16, Unlimited $28/$22) with explicit assumptions: per-user/month, monthly vs yearly billing, plan-based user/project caps, and 14-day trial, sourced live from timely.com/pricing (seq 37-41). Kimi K3: Final output lists Starter/Premium/Unlimited tier prices with explicit assumptions (monthly vs yearly billing, per-user, API access gated to Unlimited tier, 14-day trial), sourced from timelyapp.com/pricing (seq 28). Qwen 3.8 Max: README.md pricing table lists per-user/month figures with explicit assumptions (plan tier, monthly vs annual billing, user/project caps, source and check date 'timely.com/pricing, checked today'). This behavioural item does not affect the fast grade. ``` ### Activation - **Pass** — An API reference or OpenAPI spec is reachable ```text developer.timely.com returns 200 titled 'Timely API Reference', linked as API Docs from site pages. ``` - **Skipped** — An MCP server is documented and well-formed ```text No MCP server documentation found in fetched Timely pages or llms.txt. ``` - **Skipped** — A CLI install path is documented ```text No CLI install path documented; only web/desktop/Memory app installs appear. ``` - **Skipped** — SDK packages resolve on their registries ```text No SDK or package registry evidence supplied for Timely developer packages. ``` - **Skipped** — Agent skills are published ```text No agent skills published or referenced in fetched Timely documentation. ``` [Full report data](https://www.ax-check.com/timely.com/report.json)