# Agent Authentication — Agni Folio

Agni Folio (https://agnifolio.com) is a portfolio tracker and wealth
management platform. AI agents can access a user's portfolio — with the
user's explicit consent — through our MCP server at `https://agnifolio.com/mcp`.

## How to register

We support OAuth 2.0 Dynamic Client Registration (RFC 7591). No manual
approval step, no API key application form.

1. **Register your client:**

   `POST https://agnifolio.com/oauth/register`

   ```json
   {
     "client_name": "Your Agent Name",
     "redirect_uris": ["https://your-agent.example/callback"],
     "grant_types": ["authorization_code", "refresh_token"],
     "token_endpoint_auth_method": "none"
   }
   ```

   The response contains your `client_id`. Public clients (no secret) are
   supported; PKCE is mandatory.

2. **Authorize (authorization code + PKCE, S256 only):**

   Direct the user to
   `https://agnifolio.com/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&scope=agnifolio:read&state=...&code_challenge=...&code_challenge_method=S256`

   The user signs in and approves the grant. Codes are single-use; replaying
   a code revokes the tokens it issued.

3. **Exchange the code:**

   `POST https://agnifolio.com/oauth/token` with `grant_type=authorization_code`,
   `code`, `redirect_uri`, `client_id`, and your `code_verifier`.

## Scopes

| Scope | Grants |
|---|---|
| `agnifolio:read` | Read portfolio, accounts, insurance, net worth |
| `agnifolio:write` | Mutating tools (add/update entries) — every mutation is audit-logged |

## Machine-readable metadata

- Authorization server: `https://agnifolio.com/.well-known/oauth-authorization-server`
- Protected resource: `https://agnifolio.com/.well-known/oauth-protected-resource`
- MCP server card: `https://agnifolio.com/.well-known/mcp/server-card.json`
- Product summary for AI assistants: `https://agnifolio.com/llms.txt`

## Revocation

`POST https://agnifolio.com/oauth/revoke` (RFC 7009). Users can also revoke
any connected agent from Settings at any time.