# auth.md

61 Oaks Group does not run an OAuth or OIDC authorization server for AI agents. Humans sign in to 61 Oaks Hub with Microsoft at https://61oaksgroup.com.au/login.

## Agent audience

The only machine interface is the staff Hub MCP. It is not a public API. Crawlers may read marketing pages; they cannot call Hub tools without a staff token.

## Registration / provisioning

1. A 61 Oaks staff member signs in at `/login`.
2. They open **Profile → MCP access** and create a personal access token (`oaks_live_…`).
3. The token is shown once. Revocation is immediate from the same page.

There is no self-serve agent registration endpoint and no `POST /agent/auth`.

## Supported methods

- **Bearer header** on `POST /mcp` (Streamable HTTP JSON-RPC).
- Example: `Authorization: Bearer oaks_live_…`

## Credential use

Send JSON-RPC methods `initialize`, `tools/list`, `tools/call`, and `ping`. Tool results are scoped to the token owner's Hub role and Haddon membership. Do not send tokens to third parties. Do not attempt Microsoft SSO as an agent protocol.

MCP endpoint: https://61oaksgroup.com.au/mcp
Server card: https://61oaksgroup.com.au/.well-known/mcp/server-card.json