# auth.md — Favorited

REST API: https://api.api-mcp-fav-com.preprod.favorited.app · MCP server: https://mcp.api-mcp-fav-com.preprod.favorited.app/mcp

Both hosts are OAuth 2.1 **resource servers**: they issue nothing and accept only bearer access tokens that act as one signed-in Favorited user. No API keys, no client secrets, no cookies, no Web Bot Auth — and no agent self-registration (see "Not offered").

## 1. Discover

OAuth for third-party clients is **not open yet**, so no Protected Resource Metadata or authorization-server document is published: a 401 carries a bare `WWW-Authenticate: Bearer` challenge. This file and the discovery documents change the day it opens.

## 2. Register

Nothing to register today.

## 3. Authorize

Only the user’s own first-party fav.com session token is accepted — the token the fav.com web and mobile apps hold. It carries every resource scope: `user:read` (Read your profile (id, username, avatar).), `mcp:read` (Let an AI agent read your Favorited data.), `mcp:write` (Let an AI agent act on your behalf.).

## 4. Use

Send `Authorization: Bearer <access token>` to https://api.api-mcp-fav-com.preprod.favorited.app or https://mcp.api-mcp-fav-com.preprod.favorited.app/mcp.

## 5. Revoke

Signing out of fav.com ends the session the token belongs to.

## Not offered

- **Agentic self-registration** (Auth.md `agent_auth` — anonymous, identity-assertion or service registration): not offered, by design. Every credential is delegated by a signed-in user; there is no flow in which an agent obtains one without that human step.
- Web Bot Auth (every route is public documentation or bearer-protected), API keys, client secrets, service accounts.
- Anything beyond the user’s own data. See https://api.api-mcp-fav-com.preprod.favorited.app/docs.