# auth.md — Cost-Effective Software

**Audience:** AI agents and automated clients that need to authenticate with
Cost-Effective Software services. This document describes how to register and
which credentials to use.

## Public (no authentication required)
- **MCP server (read-only):** `https://www.costeffective.software/mcp` — Streamable HTTP, POST. Tools:
  `get_company_overview`, `list_industries`, `get_contact_info`, `request_consultation`.
- **Lead capture:** `POST https://www.costeffective.software/api/v1/contact` (stable alias: `/api/contact`)
- **OpenAPI spec:** `https://www.costeffective.software/openapi.json` — versioned REST API (/api/v1/) with typed error schemas, rate limits and deprecation policy.
- **Agent instructions:** `https://www.costeffective.software/agents.md` — when to use us and how to call us.
- **Markdown mirrors:** `https://www.costeffective.software/md/{path}` — every public page as markdown (or send `Accept: text/markdown`).

Public endpoints are rate-limited to 60 requests/min per IP; responses carry
IETF `RateLimit-*` headers and `Retry-After` on 429.

## Protected APIs (OAuth 2.0 / OIDC)
Protected endpoints accept JWT bearer tokens issued by our Supabase Auth server.
- Authorization server metadata: `https://www.costeffective.software/.well-known/oauth-authorization-server`
- Protected resource metadata: `https://www.costeffective.software/.well-known/oauth-protected-resource`
- Issuer: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1`
- Authorize: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/oauth/authorize`
- Token: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/oauth/token`
- JWKS: `https://huutgnkansvslafnbtbg.supabase.co/auth/v1/.well-known/jwks.json`

Send the token as: `Authorization: Bearer <access_token>`.

## Agent registration
Open dynamic client registration is not currently offered. To request
programmatic access for an autonomous agent, email **team@costeffective.software**
with your use case. We issue an OAuth client or API key with scopes appropriate
to the integration.

## Revocation
Revoke a token via the auth server: `POST https://huutgnkansvslafnbtbg.supabase.co/auth/v1/logout`.