# Auth.md

## Baskets of Joy — Agent Authentication

Baskets of Joy exposes an MCP (Model Context Protocol) server that AI agents
can connect to. Human-facing walkthrough: <https://www.basketsofjoy.in/connect>.

## Endpoints

- MCP server: `https://uplgjlglobnsatdfkvdu.supabase.co/functions/v1/mcp`
- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- API catalog: `/.well-known/api-catalog`
- MCP server card: `/.well-known/mcp/server-card.json`

## Authentication

The MCP server accepts OAuth 2.1 bearer tokens issued by the authorization
server listed in `/.well-known/oauth-protected-resource`. Dynamic client
registration is supported via the `registration_endpoint` in
`/.well-known/oauth-authorization-server` — agents should register themselves
programmatically rather than using pre-shared credentials.

- Identity types: `human`, `agent`
- Credential types: `oauth2_bearer`
- Grant types: `authorization_code` (PKCE `S256` required), `refresh_token`
- Token delivery: `Authorization: Bearer <token>` header

Tokens carry the authenticated user identity; tools authorize per-user via
row-level security. Never send a copied user-session JWT — always complete
the OAuth flow so the token carries the `client_id` claim.

## Contact

For questions about agent access, email `basketsofjoy2022@gmail.com`.