# auth.md

> Agent authentication and registration guide for 4OVER4.COM

This page is for AI agents and their developers.

## What needs no authentication

Most of the machine surface is public and tokenless:

- **MCP catalog, search, pricing, delivery, template and help tools** at `https://www.4over4.com/appsapi/mcp` (Streamable HTTP). Server card: `/.well-known/mcp/server-card.json`.
- **WebMCP tools** registered on `document.modelContext` on every page of www.4over4.com: the 23 customer tools of the AI Mode chat (account tools answer for a visitor signed in on that browser and give a sign-in hint otherwise; `cancel_order` and the coupon and coins tools are not offered), plus `navigate`, `get_page_context` and, on product pages, `start_order`.
- **UCP catalog** (`dev.ucp.shopping.catalog.search` and `dev.ucp.shopping.catalog.lookup`, version 2026-04-08) over the same MCP endpoint. Profile: `/.well-known/ucp`.
- **Content**: every page serves markdown when requested with `Accept: text/markdown`; the full knowledge tree lives at `/.well-known/okf/index.md`; overview at `/llms.txt`; agent rules at `/agents.md`.
- **Discovery**: `/.well-known/api-catalog`, `/.well-known/agent-skills/index.json`, `/.well-known/ucp`, `/sitemap.xml`.

## What needs OAuth

Account tools (`get_my_orders`, `get_order_details` for details, tracking and invoices, `cancel_order` with a two-step confirmation, `get_my_profile` for the profile, saved addresses, QR codes and designs, `get_my_coins`, and a read-only `get_cart`) require a user-scoped token obtained via OAuth 2.1 with PKCE:

1. Resource metadata: `GET /appsapi/oauth/protected-resource` (also `/.well-known/oauth-protected-resource/appsapi/mcp`) names this site's protected resource and its authorization server.
2. Authorization server discovery: the issuer is `https://www.4over4.com/appsapi/oauth`; its metadata is at `/appsapi/oauth/.well-known/oauth-authorization-server`.
3. Register with dynamic client registration (`/appsapi/oauth/register`) or use an https client id metadata document, then run authorization code + PKCE (S256). The customer signs in with their 4OVER4.COM email and password on our page; your agent never sees them.
4. Call account tools on `https://www.4over4.com/appsapi/mcp` with `Authorization: Bearer <access_token>`. Unauthenticated calls to protected tools return 401 with a `WWW-Authenticate` header pointing back at the resource metadata.

Ordering and payment never run through these tools: the buyer checks out, signed in, on www.4over4.com.

## Rules of engagement

- Respect `robots.txt` (including its Content-Signal lines) and rate-limit yourself to what a polite human session would generate.
- Prices shown by the pricing tools are live and authoritative; cached prices go stale.
- Questions: https://www.4over4.com/company/contact