# RightBlogger auth.md

Agent registration and authorization discovery for https://rightblogger.com. This file is the
skill manifest for AI agents (MCP clients and similar) that want authorized
access to RightBlogger on behalf of a user.

## Audience

Agents acting for a RightBlogger user. The protected resource is the MCP
server at `https://rightblogger.com/api/mcp` (Streamable HTTP). There is no anonymous or
service-account access; every credential is bound to a user account.

## Discover

- Protected Resource Metadata (RFC 9728): `https://rightblogger.com/.well-known/oauth-protected-resource`
- Authorization server (OAuth 2.1): `https://obadqseiepgdqhttsckf.supabase.co/auth/v1`
- Authorization server metadata (RFC 8414): `https://obadqseiepgdqhttsckf.supabase.co/.well-known/oauth-authorization-server/auth/v1`

## Register

Supported method: **verified email** (user-claimed OAuth flow).

1. Register an OAuth client via dynamic client registration (RFC 7591) at
   `https://obadqseiepgdqhttsckf.supabase.co/auth/v1/oauth/clients/register`.
2. Start an authorization code + PKCE flow at `https://obadqseiepgdqhttsckf.supabase.co/auth/v1/oauth/authorize`
   with scopes `openid email`.
3. The user signs in with a one-time email code (RightBlogger auth is
   OTP-based — their email is verified by definition) and approves the agent.
4. Exchange the code at `https://obadqseiepgdqhttsckf.supabase.co/auth/v1/oauth/token` for an access token.

No ID-JAG identity assertions and no anonymous registration are supported.

## Use

Send the access token as a Bearer token in the `Authorization` header on
requests to `https://rightblogger.com/api/mcp`. Token lifetime, refresh, and revocation
follow the authorization server metadata above.

## agent_auth

```json
{
  "agent_auth": {
    "skill": "https://rightblogger.com/auth.md",
    "register_uri": "https://obadqseiepgdqhttsckf.supabase.co/auth/v1/oauth/clients/register",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "urn:ietf:params:oauth:token-type:access_token"
      ],
      "claim_uri": "https://obadqseiepgdqhttsckf.supabase.co/auth/v1/oauth/authorize"
    }
  }
}
```