# Agent authentication — NewPlace Texas

NewPlace Texas exposes an MCP server for AI agents. Tools that touch client data
require a signed-in NewPlace user; the agent acts on behalf of that person.

## Endpoints

- MCP endpoint: `https://anyyefrsejjtzhosxhyg.supabase.co/functions/v1/mcp` (Streamable HTTP)
- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- MCP server card: `/.well-known/mcp/server-card.json`
- Human instructions: https://www.newplacetexas.com/agent-integrations

## Identity type

`human_delegated` — agents never get standalone credentials. A NewPlace user
signs in and approves the client on the consent screen at
`https://www.newplacetexas.com/.lovable/oauth/consent`.

## Registration

Dynamic Client Registration (RFC 7591) is supported:

```
POST https://anyyefrsejjtzhosxhyg.supabase.co/auth/v1/oauth/clients/register
Content-Type: application/json

{
  "client_name": "Your Agent",
  "redirect_uris": ["https://your-agent.example/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}
```

## Flow

1. Discover metadata from `/.well-known/oauth-protected-resource`.
2. Register (or reuse) a client at the registration endpoint above.
3. Run OAuth 2.1 authorization code + PKCE (`S256`) against the authorization server.
4. Send the access token as `Authorization: Bearer <token>` to the MCP endpoint.
5. Refresh with the `refresh_token` grant; revoke by removing the connection in
   your MCP client and revoking the session from your NewPlace account.

## Credential handling

- Tokens are user-scoped; row-level security applies to every request.
- Never share tokens across users or store them in client-side code.
- Report issues through https://www.newplacetexas.com/contact.