# ScapeGrowth auth.md

How AI agents authenticate to scapegrowth.com.

## Summary

Agents register themselves with OAuth 2.0 Dynamic Client Registration. No ScapeGrowth account, email or human approval is needed to register. Registration returns OAuth client credentials, which you exchange for a one-hour bearer token to call the MCP server and the A2A agent.

The REST endpoints (`/available-slots`, `/book`, `/contact`) need no credentials at all.

## Audience

Any AI agent or automated client acting on behalf of a person who wants to check ScapeGrowth's availability, book a strategy call, or send ScapeGrowth an inquiry.

## Registration

`POST https://scapegrowth.com/oauth/register` with JSON (RFC 7591).

- Machine-to-machine agent: `{"client_name": "Your Agent", "grant_types": ["client_credentials"]}`. The response includes `client_id` and `client_secret`.
- Agent acting for a person in a browser: `{"client_name": "Your Agent", "redirect_uris": ["https://your.app/callback"]}`. A public client (no secret) that uses PKCE.

Registration is anonymous: identity type `anonymous`, credential type `client_secret`. Credentials do not expire.

## Supported methods

| Grant | How |
| --- | --- |
| `client_credentials` | `POST /oauth/token` with `grant_type=client_credentials`, authenticating with `client_secret_basic` or `client_secret_post`. |
| `authorization_code` + PKCE (S256) | Send the person to `/oauth/authorize`; they approve on a consent page with no login; exchange the code at `/oauth/token`. |

Scopes: `slots:read`, `bookings:write`, `inquiries:write` (all three by default). Optional `resource`: `https://scapegrowth.com/mcp` or `https://scapegrowth.com/a2a`.

Metadata:

- Authorization server: https://scapegrowth.com/.well-known/oauth-authorization-server
- Protected resource: https://scapegrowth.com/.well-known/oauth-protected-resource (also `/mcp` and `/a2a` suffixes)
- Signing keys: https://scapegrowth.com/.well-known/jwks.json

## Credential use

Send `Authorization: Bearer <access_token>` to:

- MCP: `https://scapegrowth.com/mcp` (Streamable HTTP)
- A2A: `https://scapegrowth.com/a2a` (JSON-RPC, A2A 1.0)

Access tokens last one hour and cannot be revoked early; request a new one when it expires. A 401 response carries `WWW-Authenticate` with the `resource_metadata` URL.

## Rules for agents

- Book calls and send inquiries only on behalf of a person who asked you to. Each one reaches a real person.
- For bookings, use a `slotHour` returned by the availability tool for the same date. Other values are rejected.
- Set `consent` to `true` only if the person themselves agreed to be contacted by phone and text under the disclosure shown on scapegrowth.com.

## Contact

hello@scapegrowth.com