# Oriant auth.md

How an AI agent gets access to Oriant.

## Who this is for

AI clients (Claude Code, Cursor, Claude on web, desktop and mobile, or any MCP client) that connect to:

- **Oriant MCP** at `https://app.oriant.app/mcp`, for Owners and Admins to read their Oriant workspace.
- **MCP Connections** at `https://app.oriant.app/mcp/{name}`, the gateway in front of a company's MCP servers.

An agent always acts as one human Member of an Oriant workspace. Oriant does not create accounts for agents and has no anonymous access.

## Registration

The agent registers itself with OAuth 2.0 Dynamic Client Registration (RFC 7591). No secret is needed:

- Registration endpoint: `POST https://app.oriant.app/api/auth/oauth2/register`
- Authorization server metadata: `https://app.oriant.app/.well-known/oauth-authorization-server`
- Protected resource metadata: `https://app.oriant.app/.well-known/oauth-protected-resource/mcp` (and `/mcp/{name}` for each MCP Connection)

Oriant accepts redirect URIs from local apps on loopback callbacks, Cursor desktop and Claude's cloud.

## Supported methods

- **Authorization code with PKCE (S256).** A human Member signs in to Oriant (passkey or authenticator code) and approves the client. Scopes: `openid`, `profile`, `offline_access`.
- **Refresh token**, when `offline_access` was granted.

Verified-email, ID-JAG and anonymous agent registration are not supported.

## Using the credential

Send the access token in the `Authorization: Bearer <token>` header on every MCP request. Tokens are bound to the resource they were issued for (RFC 8707). A `401` carries a `WWW-Authenticate` header with `resource_metadata` pointing at the metadata to sign in again.