# Agent Authentication

## Service

- **Name**: Firstory MCP
- **URL**: https://firstory-mcp.vercel.app

## Registering an Agent

Firstory MCP uses OAuth 2.0 with Supabase as the upstream identity provider.

1. Discover OAuth metadata at:
   - Authorization Server: `https://firstory-mcp.vercel.app/.well-known/oauth-authorization-server`
   - Protected Resource: `https://firstory-mcp.vercel.app/.well-known/oauth-protected-resource/mcp`
2. Register a client via the OAuth dynamic client registration flow.
3. Use the authorization code grant with PKCE (S256).

## Supported Identity Types

- **email** — Supabase-authenticated email users
- **oauth** — Supabase social login providers (if configured)

## Credential Types

- **Bearer token** (JWT) — Pass as `Authorization: Bearer <token>` in HTTP headers

## Token Endpoint

- **URL**: `https://firstory-mcp.vercel.app/oauth/token`
- **JWKS**: `https://firstory-mcp.vercel.app/oauth/jwks`

## Scopes

- `openid` — OpenID Connect identity
- `profile` — User profile information
- `email` — Email address

## Revocation

Contact the service operator to revoke agent credentials.