# TradeCatalog auth.md

How AI agents and MCP clients authenticate with TradeCatalog (https://tradecatalog.app).

- **Audience:** people's own AI apps (Claude, ChatGPT, Cursor, any MCP client) acting for a TradeCatalog user.
- **Resource:** `https://tradecatalog.app/mcp` (MCP, Streamable HTTP). Protected resource metadata:
  `https://tradecatalog.app/.well-known/oauth-protected-resource/mcp`.
- **Authorization server:** `https://tradecatalog.app` — metadata at
  `https://tradecatalog.app/.well-known/oauth-authorization-server`.
- **Registration:** OAuth Client ID Metadata Documents (preferred), or Dynamic Client Registration at
  `https://tradecatalog.app/oauth/register`.
- **Flow:** authorization code with PKCE. The person signs in with their TradeCatalog login (emailed sign-in code)
  and approves access at `https://tradecatalog.app/oauth/authorize`.
- **Scope:** `tradecatalog:read` (read-only). Tokens are sent as `Authorization: Bearer` headers.
- **Credentials:** access is limited to what that person can see in the app; revoke by removing the connector.
- **No anonymous or machine-only access**, and no account creation through this flow.