# Auth.md — AI Cost Ops Agent Authentication

AI Cost Ops uses **OAuth 2.1 with PKCE** (authorization code flow) for AI agents and MCP clients.

## Endpoints

- Authorization Server metadata: [/.well-known/oauth-authorization-server](https://aicostops.com/.well-known/oauth-authorization-server)
- Protected Resource metadata: [/.well-known/oauth-protected-resource](https://aicostops.com/.well-known/oauth-protected-resource)
- Dynamic Client Registration: `https://mcp.aicostops.com/register`
- Authorization endpoint: `https://jfatbivxdtizmvqednmj.supabase.co/auth/v1/authorize`
- Token endpoint: `https://jfatbivxdtizmvqednmj.supabase.co/auth/v1/token`
- JWKS: `https://jfatbivxdtizmvqednmj.supabase.co/auth/v1/.well-known/jwks.json`

## Agent Registration

```agent_auth
register_url: https://mcp.aicostops.com/register
supported_identity_types: [oauth2, email_password]
credential_types: [bearer_jwt]
revocation_url: https://jfatbivxdtizmvqednmj.supabase.co/auth/v1/logout
grant_types_supported: [authorization_code, refresh_token]
code_challenge_methods_supported: [S256]
scopes_supported: [mcp:read, mcp:write]
```

## Supported Scopes

| Scope | Access |
|-------|--------|
| `mcp:read` | Read-only governance tools (posture, decisions, findings) |
| `mcp:write` | Approval-queue actions on paid tiers |

## Tiers

- **Free / anonymous:** public MCP tools only (`echo`, `list_blog_posts`, `get_platform_status`).
- **Copilot Governance $149+ / AI Proxy Pro $549+:** user-scoped tools via OAuth.

Contact: security@aicostops.com