# Authentication for agents

## Reading dazie

No registration is needed to read about dazie. The site, its Markdown twins and the documentation are public, and the dazie docs MCP server at https://docs.dazie.io/mcp takes no authentication.

## Acting for a user

The dazie MCP server at https://api.dazie.io/mcp works on a user's own journal, to-dos and memories. It uses OAuth 2.1 with PKCE, run by Supabase Auth:

1. Call the MCP endpoint without a token. The 401 response's `WWW-Authenticate` header points at https://api.dazie.io/.well-known/oauth-protected-resource.
2. That document names the authorization server, https://fdjvnasvcouqglaaylfm.supabase.co/auth/v1. Its metadata is at https://fdjvnasvcouqglaaylfm.supabase.co/.well-known/oauth-authorization-server/auth/v1.
3. Register your client with dynamic client registration at the `registration_endpoint` it lists. No key or approval from us is needed.
4. Send the user through the authorization endpoint. They sign in to dazie and approve access on https://app.dazie.io/oauth/consent.
5. Exchange the code for an access token and send it as `Authorization: Bearer <token>`.

The same sign-in works for the dazie A2A agent at https://api.dazie.io/a2a (JSON-RPC, A2A v1.0). Its card is at https://www.dazie.io/.well-known/agent-card.json and its resource metadata at https://api.dazie.io/.well-known/oauth-protected-resource/a2a. It answers questions about the user's journal and changes nothing.

Over MCP, the agent can read the user's journal, insights, transcripts, to-dos, memories and call schedule, and write journal entries, to-dos and memories. It cannot delete anything, place calls or change the account.

## Creating an account

Agents cannot register a dazie account on a person's behalf. A person registers at https://app.dazie.io/ with an email address and password and confirms it by email.

## Contact

niklas@dazie.io