# Auth.md

# Artie Authentication

Artie supports OAuth registration for agents operating the hosted MCP service. The protected resource is https://mcp.artie.com/mcp and its authorization server is https://loyal-explorer-16.authkit.app.

## Discover

Read the protected-resource metadata first:

https://artie.com/.well-known/oauth-protected-resource

It identifies https://mcp.artie.com/mcp as the resource and names the AuthKit authorization server. For root-domain discovery, fetch the Artie authorization-server metadata bridge:

https://artie.com/.well-known/oauth-authorization-server

It mirrors AuthKit's OAuth registration metadata and adds the agent_auth block. Use the AuthKit issuer metadata for the authoritative OAuth endpoint set:

https://loyal-explorer-16.authkit.app/.well-known/oauth-authorization-server

The MCP service returns OAuth 401 challenges with its resource metadata URL. Treat protected-resource metadata and authorization-server metadata as the runtime source of truth.

## Register and obtain a credential

Artie uses AuthKit OAuth 2.0/OIDC, including dynamic client registration and client ID metadata documents where supported. Use the authorization-code flow with PKCE, request a token for https://mcp.artie.com/mcp, and present it as an Authorization bearer token. Do not send an Artie API key to the MCP endpoint.

Agents can register without an identity assertion. Artie does not publish an auth.md claim ceremony or registration-level revocation endpoint; do not infer those endpoints from this document.

## Use the MCP service

MCP endpoint:

https://mcp.artie.com/mcp

Access is limited to the authenticated user's authorized Artie company and environment. Clients should keep confirmation enabled for operations that create, modify, pause, start, or delete resources. Do not reuse an MCP token for another Artie API audience unless Artie's token exchange explicitly supports that audience.

## API discovery

API base URL:

https://api.artie.com

API catalog:

https://artie.com/.well-known/api-catalog

OpenAPI description:

https://www.artie.com/docs/api/openapi.yaml

## Revoke access

Users can disconnect or revoke an authorized client from Artie's account settings. Clients should discard cached tokens after revocation.