# Auth.md

Site: Hooked Ontario (https://www.hookedontario.ca)
Contact: hello@hookedontario.ca

## Agent authentication — Hooked Ontario

Hooked Ontario exposes a remote MCP server. Its tools act on behalf of a
signed-in Hooked Ontario user, so agents must authenticate with OAuth 2.1.

## Endpoints

- MCP endpoint: `https://cupfhcxtvxywodcdhoeg.supabase.co/functions/v1/mcp`
- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- OpenID Connect discovery: `/.well-known/openid-configuration`
- MCP server card: `/.well-known/mcp/server-card.json`

## Registration

Dynamic client registration (RFC 7591) is enabled. Register at:

```
POST https://cupfhcxtvxywodcdhoeg.supabase.co/auth/v1/oauth/clients/register
```

No pre-shared client secret is required; public clients using PKCE (`S256`)
are supported.

## Flow

1. Discover metadata from `/.well-known/oauth-authorization-server`.
2. Register (or reuse) a client.
3. Run the authorization code flow with PKCE. The user signs in to Hooked
   Ontario and approves the connection on the consent screen at
   `https://www.hookedontario.ca/.lovable/oauth/consent`.
4. Send the resulting access token as `Authorization: Bearer <token>` on
   every MCP request.

## Identity and revocation

- Identity type: end user (human account holder).
- Credential type: OAuth 2.1 authorization code + PKCE, refreshable.
- Tokens are scoped to the authenticated user; all data access is enforced by
  row-level security as that user.
- Users can revoke a connection at any time from their account settings, or by
  contacting hello@hookedontario.ca.

## Human help

Contact hello@hookedontario.ca for help connecting an assistant.