# auth.md

OfflineCreator Studio supports agent registration through OAuth 2.0
Authorization Code with PKCE and RFC 7591 dynamic client registration.

## Audience

Agents that need to generate images or videos, list models, or read generation
status for a Studio user.

## Protected resource

- Resource: `https://mcp.offlinecreatorstudio.com/mcp`
- Protected Resource Metadata: `https://mcp.offlinecreatorstudio.com/.well-known/oauth-protected-resource`
- Authorization server: `https://mcp.offlinecreatorstudio.com`
- Scopes: `models`, `read`, `generate`
- Bearer method: `Authorization` header

## Registration methods

1. **OAuth dynamic client registration** — `POST https://mcp.offlinecreatorstudio.com/oauth/register`
2. **Browser consent** — send the user to `https://mcp.offlinecreatorstudio.com/authorize`
3. **Local stdio provisioning** — create a personal key at https://offlinecreatorstudio.com/settings for `npx -y @offlinecreator/mcp` only

Remote clients must not embed API keys. After registration, exchange the
authorization code at `https://mcp.offlinecreatorstudio.com/oauth/token` and call
`https://mcp.offlinecreatorstudio.com/mcp`.

## Agent auth metadata

Machine-readable registration lives on Authorization Server metadata as
`agent_auth`, including `skill`, `register_uri`, and the implemented
dynamic client registration and Authorization Code + PKCE methods.