# auth.md

Kody is Your agents' cloud: an OAuth-protected MCP cloud for individuals and teams.
Agents connect at `https://kody.codes/mcp` from an existing MCP host. People complete
sign-in and consent in the browser; do not ask anyone to paste credentials
or tokens into chat.

## Add the MCP server

1. Point the host at `https://kody.codes/mcp`.
2. Complete the OAuth flow the host opens. Sign in to Kody if needed,
   then approve access.
3. The account email must be verified before authorize can finish. If
   authorize asks to verify, keep that tab open, finish verification
   from the email link or `/pending-verification`, then continue.
4. After the connection works, call `search` before `execute`.

Client-specific setup (Cursor, ChatGPT, Claude Desktop, Claude Code,
Codex, Copilot, Grok, OpenCode, OpenClaw, Muse) lives on `/onboarding`. A
no-account capability tour is at `https://kody.codes/docs/what-is-kody.md`;
the full docs index is `https://kody.codes/llms.txt`.

## OAuth

- Authorization server: `https://kody.codes/.well-known/oauth-authorization-server`
- Protected resource: `https://kody.codes/.well-known/oauth-protected-resource/mcp`
- Resource: `https://kody.codes/mcp`
- Scopes: `openid`, `profile`, `email`
- Dynamic client registration: `https://kody.codes/oauth/register`
- Client ID Metadata Documents (CIMD) are supported.

## agent_auth

```json
{
  "skill": "connect-kody",
  "register_uri": "https://kody.codes/oauth/register",
  "methods": [
    {
      "type": "oauth2",
      "grant_types": [
        "authorization_code",
        "refresh_token"
      ],
      "authorization_endpoint": "https://kody.codes/oauth/authorize",
      "token_endpoint": "https://kody.codes/oauth/token",
      "registration_endpoint": "https://kody.codes/oauth/register",
      "client_id_metadata_document_supported": true,
      "scopes": [
        "openid",
        "profile",
        "email"
      ],
      "resource": "https://kody.codes/mcp",
      "bearer_methods_supported": [
        "header"
      ]
    }
  ]
}
```