# auth.md

Agent authentication for Layerre.

## Audience

AI agents and automation clients that need to call Layerre: the hosted MCP server and/or the REST API.

## Methods

### 1. MCP (recommended for agents)

- Endpoint: `https://mcp.layerre.com/mcp` (Streamable HTTP)
- Auth: OAuth 2.1 + PKCE via the Layerre / Supabase authorization server
- Protected resource metadata: `https://mcp.layerre.com/.well-known/oauth-protected-resource`
- Mirror on this site: `https://layerre.com/.well-known/oauth-protected-resource`
- Authorization server issuer: `https://dtzpqdilmtbttdrwhboy.supabase.co/auth/v1`
- AS discovery: `https://dtzpqdilmtbttdrwhboy.supabase.co/auth/v1/.well-known/oauth-authorization-server`
- Human docs: https://layerre.com/docs/mcp/

Clients open a browser for the user to sign in and approve access. No client secret is required for public MCP clients (`token_endpoint_auth_methods_supported` includes `none`).

### 2. API key (REST API and headless MCP)

1. Create an account at https://layerre.com/
2. Open https://layerre.com/app/api-keys and create a key (`lyr_…`)
3. Call `https://api.layerre.com/v1/…` with `Authorization: Bearer lyr_…`
4. Or send the same header to `https://mcp.layerre.com/mcp` for headless MCP

OpenAPI: https://layerre.com/openapi.json
API docs: https://layerre.com/docs/

## Credential use

- Prefer short-lived OAuth access tokens for interactive agents (MCP).
- Prefer API keys only for trusted server-side / CI workloads.
- Do not embed API keys in public agent skill files or client-side WebMCP tools.
- Rotate compromised keys in the dashboard; revoke OAuth clients via the authorization server when available.

## Notes

The public REST API does **not** yet expose a first-party OAuth authorization server on `layerre.com`. OAuth today covers the MCP resource. Site-wide OIDC/AS metadata and Auth.md `agent_auth` registration flows are planned separately.