# Auth.md

> Agent authentication for TexasAI.Consulting

This site exposes an MCP server for AI agents. Tools that read client data
require a human-delegated OAuth 2.1 access token; nothing is available to
anonymous agents.

## Endpoints

- MCP server: `https://ptndvzolanfdesrqagko.supabase.co/functions/v1/mcp`
- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- Human-readable connection guide: `/connect`

## Registration

Clients register dynamically (RFC 7591) at the `registration_endpoint`
published in the authorization server metadata. No pre-shared client secret
is issued; public clients must use PKCE (`S256`).

## Obtaining a token

1. Discover metadata from `/.well-known/oauth-protected-resource`.
2. Register (or reuse) an OAuth client at the authorization server.
3. Run the authorization code + PKCE flow. The user signs in to
   TexasAI.Consulting and approves the connection on the consent screen.
4. Send the access token as `Authorization: Bearer <token>` to the MCP endpoint.

## Identity and scope

- Identity type: human-delegated (the agent acts as the signed-in user).
- Credential type: OAuth 2.0 access token (JWT), audience `authenticated`.
- Row-level security applies: an agent only ever sees the data its user can see.
- No custom scopes are defined; access is determined by the user's own permissions.

## Revocation

Users revoke agent access by removing the connection from their client, or by
contacting dayna@newplacetexas.com to have the session invalidated.