# auth.md - SavedThat Agent Authentication

SavedThat's API is authenticated with OAuth 2.0 Bearer tokens issued by our
authorization server (Supabase Auth / GoTrue).

## Discovery

- Protected-resource metadata: https://savedthat.app/.well-known/oauth-protected-resource
- Authorization server (issuer): https://savedthat.app (tokens minted by Supabase Auth)
- Authorization server metadata: https://savedthat.app/.well-known/oauth-authorization-server
- OpenID configuration: https://savedthat.app/.well-known/openid-configuration
- API description: https://savedthat.app/openapi.json

## How to authenticate

1. Obtain an access token from the authorization server above using
   Authorization Code + PKCE (scopes: `openid`, `profile`, `email`).
2. Call the API with the header `Authorization: Bearer <access_token>`.
3. Rate limits apply per endpoint (search 30/min, save 10/min).

## Agent / programmatic registration

MCP clients register themselves with Dynamic Client Registration (the
registration_endpoint in the metadata above). For other programmatic access,
contact hello@savedthat.app. Human users sign in at https://savedthat.app/login.