# auth.md

StaffToDo Portal authentication and agent registration.

## Public Access
- Public discovery endpoints are listed in `/llms.txt` and `/.well-known/api-catalog`.
- The app shell is not intended to be indexed as marketing content.

## Private Access
- Workspace data requires a StaffToDo account and role-based authorization.
- Setup codes, task text, attachments, and user records are private.

## Agent Registration
- Public agents do not need registration to use the discovery docs.
- MCP endpoint: `/mcp` (Streamable HTTP). It signs the person in with OAuth 2.1 (PKCE, dynamic client registration at `/oauth/register`) or accepts a personal key created on `/connected-apps`.
- Authorization server metadata: `/.well-known/oauth-authorization-server`; protected resource metadata: `/.well-known/oauth-protected-resource/mcp`.
- Every MCP tool acts as the signed-in person with their own workspace role; there is no anonymous workspace access.
- Provisioning contact: mailto:support@stafftodo.com