# MagicPixel — Agent Registration

MagicPixel authenticates AI agents with **OAuth 2.1** (authorization code +
PKCE) via Supabase Auth. Dynamic Client Registration ([RFC 7591]) is enabled,
so agents can register themselves without operator intervention.

## Endpoints

| Purpose | URL |
| --- | --- |
| Authorization server metadata | `https://magicpixel.art/.well-known/oauth-authorization-server` |
| Protected resource metadata   | `https://magicpixel.art/.well-known/oauth-protected-resource` |
| MCP server card               | `https://magicpixel.art/.well-known/mcp/server-card.json` |
| MCP endpoint (resource URL)   | `https://sddsilidjhvtvejzvolx.supabase.co/functions/v1/mcp` |
| Authorization endpoint        | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/authorize` |
| Token endpoint                | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/token` |
| Dynamic Client Registration   | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/oauth/clients` |
| JWKS                          | `https://sddsilidjhvtvejzvolx.supabase.co/auth/v1/.well-known/jwks.json` |
| User consent screen           | `https://magicpixel.art/.lovable/oauth/consent` |

## Registration flow

1. Fetch `/.well-known/oauth-authorization-server` from `magicpixel.art` (or the
   Supabase issuer directly).
2. `POST` a client registration document to `registration_endpoint` — supply
   `client_name`, `redirect_uris`, `grant_types: ["authorization_code",
   "refresh_token"]`, and `token_endpoint_auth_method: "none"` for public
   clients.
3. Begin the authorization code flow with PKCE against `authorization_endpoint`.
   MagicPixel will present its consent screen; the human user approves or
   denies. On approval the browser is redirected to your `redirect_uri` with an
   authorization code.
4. Exchange the code at `token_endpoint` for an access token. Use that token as
   `Authorization: Bearer <token>` when calling the MCP endpoint above.
5. Tokens are short-lived; refresh with the standard `grant_type=refresh_token`.

Access tokens are Supabase JWTs with `aud=authenticated`; they carry no OAuth
scopes. Tool authorization is derived from the user's MagicPixel account and
row-level security policies.

## Human-driven setup

Individual users can connect Claude, ChatGPT, Cursor, or any MCP client by
pasting the MCP endpoint above into their client's connectors panel. See
[https://magicpixel.art/connect](https://magicpixel.art/connect) for
click-by-click instructions and how to refresh the tool list after we ship
updates.

## Identity & credential types

- `supported_identity_types`: `human`
- `credential_types`: `oauth2`

MagicPixel does not support agent-only (unattended) identities today. Every
call runs as a real MagicPixel user account, and tool access is scoped to
that user's projects, assets, and credit balance.

## Contact

Questions or integration issues → open an issue on the MagicPixel GitHub or
email the address listed on [magicpixel.art](https://magicpixel.art).

[RFC 7591]: https://www.rfc-editor.org/rfc/rfc7591