# Auth.md — Agent authentication for Rücker Curi

The public website does not require authentication. Authorized WordPress administration through the Novamira MCP server uses OAuth 2.0.

## Discovery

- Protected resource metadata: https://curi.adv.br/.well-known/oauth-protected-resource
- Authorization server metadata: https://curi.adv.br/.well-known/oauth-authorization-server
- MCP endpoint: https://curi.adv.br/wp-json/mcp/novamira-oauth
- Scope: `mcp`

## Supported flows

The authorization server metadata is the source of truth. It currently advertises Authorization Code with PKCE, refresh tokens, Device Authorization and dynamic client registration. Human authorization is required.

## Important boundary

This service does not advertise anonymous agent accounts, identity-assertion registration or a commercial signup flow. Do not send credentials in URLs and do not treat this document as authorization to access private data.