# Auth.md

## MagicPixel — Agent Registration

MagicPixel authenticates AI agents with **OAuth 2.1** (authorization code +
PKCE) via Supabase Auth. Dynamic Client Registration ([RFC 7591]) is enabled,
so agents can register themselves without operator intervention.

## Endpoints

| Purpose | URL |
| --- | --- |
| Authorization server metadata | `https://magicpixel.art/.well-known/oauth-authorization-server` |
| Protected resource metadata   | `https://magicpixel.art/.well-known/oauth-protected-resource` |
| MCP server card               | `https://magicpixel.art/.well-known/mcp/server-card.json` |
| DNS-AID HTTP index            | `https://magicpixel.art/.well-known/agents-index.json` |
| MCP endpoint (resource URL)   | `https://magicpixel.art/mcp` (metadata: `/.well-known/oauth-protected-resource/mcp`) |
| MCP endpoint (legacy alias)   | `https://sddsilidjhvtvejzvolx.supabase.co/functions/v1/mcp` |
| Authorization endpoint        | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/oauth/authorize` |
| Token endpoint                | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/oauth/token` |
| Dynamic Client Registration   | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/oauth/clients/register` |
| JWKS                          | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/.well-known/jwks.json` |
| User consent screen           | `https://magicpixel.art/oauth/consent` |

## Discovery

1. Fetch `https://magicpixel.art/.well-known/oauth-protected-resource` (RFC 9728).
   It names the MCP resource URL, `authorization_servers`, and an `agent_auth`
   block. A `.json` alias is also served.
2. Fetch `/.well-known/oauth-authorization-server` from `magicpixel.art` for
   the same `agent_auth` block plus authorize / token / registration URLs.
   The issuer itself is Supabase Auth (`…/auth/v1`); its native metadata does
   not include `agent_auth`, so prefer the MagicPixel copy.

## Registration flow

1. `POST` a client registration document to `registration_endpoint` — supply
   `client_name`, `redirect_uris`, `grant_types: ["authorization_code",
   "refresh_token"]`, and `token_endpoint_auth_method: "none"` for public
   clients.
2. Begin the authorization code flow with PKCE against `authorization_endpoint`.
   MagicPixel will present its consent screen; the human user approves or
   denies. On approval the browser is redirected to your `redirect_uri` with an
   authorization code.
3. Exchange the code at `token_endpoint` for an access token. Use that token as
   `Authorization: Bearer <token>` when calling the MCP endpoint above.
4. Tokens are short-lived; refresh with the standard `grant_type=refresh_token`.

Access tokens are Supabase JWTs with `aud=authenticated`; they carry no OAuth
scopes. Tool authorization is derived from the user's MagicPixel account and
row-level security policies.

## Human-driven setup

Individual users can connect Claude, ChatGPT, Cursor, or any MCP client by
pasting the MCP endpoint above into their client's connectors panel. See
[https://magicpixel.art/guides/connect](https://magicpixel.art/guides/connect) for
click-by-click instructions and how to refresh the tool list after we ship
updates.

## Identity & credential types

`agent_auth` on both well-known documents advertises:

- `register_uri`: Dynamic Client Registration (RFC 7591)
- `supported_identity_types`: `human`
- `credential_types`: `oauth2`
- `consent_uri`: `https://magicpixel.art/oauth/consent`
- `documentation` / `skill`: this file (`https://magicpixel.art/auth.md`)

Claim, identity-assertion, and agent-identity revocation URLs are **not
applicable**. MagicPixel does not support agent-only (unattended) identities
today. Every call runs as a real MagicPixel user account, and tool access is
scoped to that user's projects, assets, and credit balance.

## Contact

Questions or integration issues → open an issue on the MagicPixel GitHub or
email the address listed on [magicpixel.art](https://magicpixel.art).

[RFC 7591]: https://www.rfc-editor.org/rfc/rfc7591

## DNS-AID

HTTP index (live, no DNS required):

- `https://magicpixel.art/.well-known/agents-index.json`
- alias: `https://magicpixel.art/.well-known/agent-index.json`

Agents that support `dns-aid discover --use-http-index` can read the MCP
endpoint from that document. The isitagentready.com DNS-AID check still
requires SVCB/HTTPS records and DNSSEC, which are **not** published yet.

Operator follow-up — paste into the `magicpixel.art` zone and enable DNSSEC:

```text
_index._agents.magicpixel.art. 3600 IN HTTPS 1 . alpn="h2" endpoint="https://magicpixel.art/mcp"
_mcp._agents.magicpixel.art.   3600 IN HTTPS 1 . alpn="h2" endpoint="https://magicpixel.art/mcp"
```