# auth.md — CeylonCharts OAuth issuer

Technical registration and token-exchange flow for AI agents / MCP clients connecting to the CeylonCharts MCP server. For the product-level overview and consent flow, see https://www.ceyloncharts.com/auth.md.

## Flow

1. **Discover** — `GET /.well-known/oauth-protected-resource` on `mcp.ceyloncharts.com`, then `GET /.well-known/oauth-authorization-server` on `oauth.ceyloncharts.com`.
2. **Register** — `POST /register` (RFC 7591 dynamic client registration, no auth required) with a JSON body containing `redirect_uris`; returns `client_id`.
3. **Authenticate** — direct the end user through `GET /authorize` (authorization_code + PKCE; `resource` must equal the protected resource, `scope` from `mcp:read`/`mcp:analyze`). This requires a real CeylonCharts account login and consent at `https://www.ceyloncharts.com/oauth/consent` — there is no anonymous or non-interactive identity flow.
4. **Exchange** — `POST /token` with `grant_type=authorization_code`, the returned `code`, and `code_verifier`.
5. **Use** — send the `access_token` as a `Bearer` token against `https://mcp.ceyloncharts.com/mcp`. Tokens expire in 900 seconds.
6. **Refresh** — `POST /token` with `grant_type=refresh_token`.
7. **Revoke** — `POST /revoke` with the refresh token.