# auth.md — Cost-Effective Software

**Audience:** AI agents and automated clients that need to authenticate with
Cost-Effective Software services. This document describes how to register and
which credentials to use.

## Public (no authentication required)
- **MCP server (read-only):** `https://www.costeffective.software/mcp` — Streamable HTTP, POST. Tools:
  `get_company_overview`, `list_industries`, `get_contact_info`, `request_consultation`.
- **Lead capture:** `POST https://www.costeffective.software/api/contact`
- **OpenAPI spec:** `https://www.costeffective.software/openapi.json` — machine-readable description of the public REST API.
- **Markdown mirrors:** `https://www.costeffective.software/md/{path}` — every public page as markdown (or send `Accept: text/markdown`).

## Protected APIs (OAuth 2.0 / OIDC)
Protected endpoints accept JWT bearer tokens issued by our Supabase Auth server.
- Authorization server metadata: `https://www.costeffective.software/.well-known/oauth-authorization-server`
- Protected resource metadata: `https://www.costeffective.software/.well-known/oauth-protected-resource`
- Issuer: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1`
- Authorize: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/oauth/authorize`
- Token: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/oauth/token`
- JWKS: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/.well-known/jwks.json`

Send the token as: `Authorization: Bearer <access_token>`.

## Agent registration
Open dynamic client registration is not currently offered. To request
programmatic access for an autonomous agent, email **team@costeffective.software**
with your use case. We issue an OAuth client or API key with scopes appropriate
to the integration.

## Revocation
Revoke a token via the auth server: `POST https://huutgnkansvslafnbtbg.supabase.co/auth/v1/logout`.