# eArgentina auth.md

## Public reading
Public MCP: https://e-ar-research.measurable.workers.dev/mcp. Search and retrieve published guides without credentials. Preserve dates, caveats and official sources.

## Agent registration
POST https://e-ar-research.measurable.workers.dev/agent/auth with application/json {"name":"Your assistant"}. Anonymous registration returns a secret bearer credential and an expiring claim_uri, initially without private access. The human owner must sign in with a passkey, inspect the agent name and explicitly approve workspace:read and/or workspace:write at the claim link within ten minutes. Claimed access expires after seven days. Send the credential only in Authorization: Bearer to https://e.ar/mcp/private. Never share it in a URL.

Alternatively register an OAuth client at https://e-ar-research.measurable.workers.dev/oauth/register, then use authorization code + S256 PKCE and explicit human consent at https://e-ar-research.measurable.workers.dev/authorize. Resource audience: https://e.ar; protected endpoint: https://e.ar/mcp/private. Scopes: workspace:read, workspace:write. Access tokens last 15 minutes; refresh tokens are not issued.

## Ownership and revocation
The owner's workspace lists and revokes connections at https://e-ar-research.measurable.workers.dev/workspace. Revocation immediately blocks subsequent private requests. Export and permanent workspace deletion are available there. Public research remains anonymous.

Store only canonical guide references and checklist status. No identity documents, applications, payments, personal case notes or eligibility decisions are supported.