# auth.md — Kommunity agent authentication

## Organizer MCP: OAuth with human consent

Use https://api.kommunity.com/api/mcp/organizer, or connect through the published Claude listing at https://claude.ai/directory/kommunity-organizer.

1. Read https://api.kommunity.com/.well-known/oauth-protected-resource/api/mcp/organizer.
2. Read the advertised issuer’s metadata at https://api.kommunity.com/.well-known/oauth-authorization-server.
3. POST public-client metadata to the advertised registration_endpoint. Supply client_name, redirect_uris, token_endpoint_auth_method=none and the needed scope string. Registration creates an OAuth application, not a user account or a community grant.
4. Open the authorization_endpoint using response_type=code, the registered client_id and redirect_uri, the MCP resource URL, and PKCE S256. Validate state in the callback. The human signs in as an organizer, selects one community and explicitly approves scopes.
5. Exchange the authorization code at the advertised token_endpoint with the PKCE verifier and resource indicator. Use the returned Bearer token only with this MCP resource. Access tokens last one hour; rotating refresh tokens last up to 30 days.
6. Revoke a token through the advertised revocation_endpoint, or revoke the connection’s client in Developer → Clients for immediate disconnection.

Tokens are sent in the Authorization header, never in URLs or prompts. Discover capabilities before invoking tools. Read https://kommunity.com/organizer-mcp/ and the kommunity://organizer/guide resource for operational constraints.

## Existing Developer API service clients

A community organizer can provision a client_id and client_secret in Developer → Clients. Exchange these at https://api.kommunity.com/api/oauth/token using grant_type=client_credentials. Those tokens are for the community-scoped Developer API, not the isolated MCP OAuth flow. Keep credentials in secret storage. Each grant remains subject to the current client scopes and community policies.

## Registration profile compatibility

Kommunity supports RFC 7591 OAuth client registration and human-approved authorization-code/PKCE access. It does not implement WorkOS auth.md identity assertions, ID-JAG, anonymous account registration, JWT-bearer identity exchange or a claim ceremony. No agent_auth metadata claiming those registration methods is advertised. A site scanner requiring that separate protocol may report this profile as unsupported.