# Artboar auth.md

## Anonymous access

Agents can connect directly to **https://mcp.artboar.com/mcp** using Streamable
HTTP. No signup, identity assertion, API key, or OAuth token is required.
`create_project` issues a private workspace capability; supply it together with
the workspace ID to subsequent tools. There are no user accounts or ownership
claims. Never publish capabilities. Workspaces expire after 24 hours.

## Agent registration with optional OAuth

Clients that require OAuth can use the canonical **https://artboar.com** endpoint.
Its protected-resource metadata is
https://artboar.com/.well-known/oauth-protected-resource and its exact OAuth
resource identifier is `https://artboar.com` (without a trailing slash).
JSON MCP POST requests at the site root are forwarded to the hosted MCP service;
ordinary browser GET requests continue to show the homepage. This is an
OAuth-protected alternative to the anonymous endpoint, not an account login.
The issuer is **https://mcp.artboar.com**.
The service uses stateless POST-only Streamable HTTP. An SSE GET returns 401
without a token and 405 after authorization; clients should send JSON MCP POSTs.

Existing clients can continue using **https://mcp.artboar.com/mcp/oauth** with
resource `https://mcp.artboar.com/mcp/oauth` and its path-specific metadata below.
Tokens are bound to exactly one resource and cannot be used at the other endpoint.

This guide documents anonymous MCP access and OAuth client registration for AI
agents. Artboar does not implement the WorkOS agent-registration identity or
ownership-claim protocol. Registration provisions a client ID; browser consent
is required before the client receives an access token.

- Authorization server metadata: https://mcp.artboar.com/.well-known/oauth-authorization-server
- Protected resource metadata: https://mcp.artboar.com/.well-known/oauth-protected-resource/mcp/oauth
- Register a public client: `POST https://mcp.artboar.com/oauth/register`
- Browser consent: `GET https://mcp.artboar.com/oauth/authorize`
- Exchange an authorization code: `POST https://mcp.artboar.com/oauth/token`
- Revoke a token: `POST https://mcp.artboar.com/oauth/token` with `token` and `client_id` form fields (no `grant_type`)

Register with a client name, exact redirect URI, `token_endpoint_auth_method`
`none`, `grant_types` containing `authorization_code`, and `response_types`
containing `code`. Use HTTPS redirects or HTTP loopback redirects for local clients.
Registration is rate limited; it is not an email-verification or identity service.

### 1. Register the agent's OAuth client

Send JSON to `POST /oauth/register` on `https://mcp.artboar.com`:

```sh
curl --request POST https://mcp.artboar.com/oauth/register \
  --header 'Content-Type: application/json' \
  --data '{"client_name":"My Artboar agent","redirect_uris":["http://127.0.0.1:8765/callback"],"token_endpoint_auth_method":"none","grant_types":["authorization_code"],"response_types":["code"]}'
```

The JSON response contains `client_id`. Save it for authorization and revocation.
It is a public client identifier, not a bearer credential. Register only once per
client configuration; registrations expire after seven days.

### 2. Authorize with browser consent and PKCE

Request scope `artboar:tools`, resource `https://artboar.com`, a random
state value, and PKCE with `code_challenge_method=S256`. Open the authorization
URL for the user to review the client, redirect destination, and requested access.
Generate a fresh cryptographically random verifier of 43–128 characters and
compute `BASE64URL(SHA256(verifier))` without padding. Navigate to
`https://mcp.artboar.com/oauth/authorize` with these query parameters:

```text
response_type=code
client_id=<registered client ID>
redirect_uri=http://127.0.0.1:8765/callback
scope=artboar:tools
resource=https://artboar.com
state=<fresh random state>
code_challenge=<S256 challenge>
code_challenge_method=S256
```

After approval, validate the returned state and `iss=https://mcp.artboar.com`.
Exchange the returned code using `POST /oauth/token`, with an
`application/x-www-form-urlencoded` body containing `grant_type=authorization_code`,
`client_id`, `code`, the exact `redirect_uri`, `resource`, and `code_verifier`.

### 3. Use and revoke the credential

The token response contains `access_token`, `token_type=Bearer`, and
`expires_in=900`. Send the resulting credential in the
HTTP `Authorization: Bearer <access_token>` header. Never put tokens in URLs.

Access tokens last 15 minutes. Offline access and refresh tokens are not offered;
repeat browser authorization when access expires. Revoke an access token using
the revocation endpoint with the issuing client ID. Revocation is backed by
Cloudflare KV and may take time to propagate; access tokens expire independently.

OAuth grants only access to the tool transport. Each workspace still requires its
own private capability. Approval does not grant access to existing artwork,
browser drafts, personal identity, uploads, or other clients' workspaces. Revoking
an OAuth token does not delete artwork or revoke a workspace capability: use
`delete_project` when workspace deletion is intended. The anonymous endpoint
remains available under the same rate limits and capability checks.

For editing instructions, read https://artboar.com/agents/ or the
[Artboar skill](https://artboar.com/.well-known/agent-skills/artboar/SKILL.md).