# auth.md

Delegance Brokerage exposes agent-facing operations (policy search, COI generation,
quote requests, endorsements) over an MCP server and an A2A agent. Agents that need
to act on behalf of a Delegance customer register and authenticate via OAuth 2.0.

## Audience

AI agents and MCP/A2A clients (ChatGPT, Claude, and any OAuth 2.0 / RFC 7591 client)
acting for an authenticated Delegance customer.

## OAuth discovery

- Authorization Server Metadata (RFC 8414): https://portal.delegancebrokerage.com/.well-known/oauth-authorization-server
- Protected Resource Metadata (RFC 9728): https://portal.delegancebrokerage.com/.well-known/oauth-protected-resource

The authorization server `issuer` is `https://portal.delegancebrokerage.com`.

## Registration

Delegance supports OAuth 2.0 Dynamic Client Registration (RFC 7591). Register a client
by POSTing client metadata to:

    https://portal.delegancebrokerage.com/api/oauth/register

You must supply `redirect_uris` from the supported callback set (ChatGPT, Claude/mcp,
and localhost loopback for desktop clients). The endpoint returns a `client_id` (and a
`client_secret` when `token_endpoint_auth_method` is `client_secret_post`/`_basic`).

## Authentication

Use the registered client in the OAuth 2.0 Authorization Code flow with PKCE (S256):

1. Authorize: https://portal.delegancebrokerage.com/api/oauth/authorize
2. Exchange the code at: https://portal.delegancebrokerage.com/api/oauth/token
3. Call MCP/API endpoints with `Authorization: Bearer <access_token>`.

Scopes: `policies:read`, `policies:write`, `documents:read`, `documents:write`,
`coi:generate`, `quotes:read`, `quotes:write`.

## Credentials

Bearer access tokens are passed in the `Authorization` header. Client secrets (when
issued) are shown once at registration and stored only as a hash by Delegance.