# FastFormat auth.md

FastFormat supports browser-based account authentication for users and protected API access through the existing web application session.

MCP clients self-register at https://fastformat.co/oauth/register (RFC 7591) as public clients with authorization code and PKCE S256. Agents that need another kind of delegated API access should use the service_auth registration path and contact support@fastformat.co with:

- agent name and operator;
- user email or account domain;
- intended API use;
- callback or origin information;
- requested scopes.

Supported agent registration metadata:

- registration URI: https://fastformat.co/auth.md
- identity types: service_auth with email identity
- credential types: browser-session
- claim URI: https://fastformat.co/accounts/login/
- revocation URI: https://fastformat.co/accounts/logout/

agent_auth metadata:

```json
{
  "skill": "https://fastformat.co/auth.md",
  "register_uri": "https://fastformat.co/auth.md",
  "claim_uri": "https://fastformat.co/accounts/login/",
  "revocation_uri": "https://fastformat.co/accounts/logout/",
  "identity_types_supported": ["service_auth"],
  "credential_types_supported": ["browser-session"],
  "service_auth": {
    "identity_types_supported": ["email"],
    "credential_types_supported": ["browser-session"],
    "claim_uri": "https://fastformat.co/accounts/login/",
    "revocation_uri": "https://fastformat.co/accounts/logout/"
  }
}
```

Discovery metadata:

- OAuth authorization server metadata: https://fastformat.co/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://fastformat.co/.well-known/oauth-protected-resource
- API catalog: https://fastformat.co/.well-known/api-catalog