# PrivSource auth.md

PrivSource supports OAuth 2.0 authorization for agents and MCP clients.

## OAuth metadata

- Protected resource metadata: https://api.privsource.com/.well-known/oauth-protected-resource
- MCP protected resource metadata: https://api.privsource.com/.well-known/oauth-protected-resource/mcp
- Authorization server metadata: https://www.privsource.com/.well-known/oauth-authorization-server
- Agent Skills index: https://www.privsource.com/.well-known/agent-skills/index.json
- Dynamic client registration: https://www.privsource.com/oauth/register
- Authorization endpoint: https://www.privsource.com/oauth/authorize
- Token endpoint: https://www.privsource.com/oauth/token
- Revocation endpoint: https://www.privsource.com/oauth/revoke

## Supported clients

Agents should register an OAuth client with dynamic client registration, request the `mcp:api` scope, and use the authorization code flow with PKCE. Refresh tokens are available with the `offline_access` scope.

## MCP endpoint

- https://api.privsource.com/mcp

Users authorize agents against a PrivSource team before account data or tools are available.

## Documentation

- Docs home: https://www.privsource.com/docs
- MCP integration: https://www.privsource.com/docs/mcp-integration
- REST API: https://www.privsource.com/docs/rest-api