# auth.md — Authenticating with SkedCast

SkedCast runs an OAuth 2.1 authorization server. Agents authenticate with an
OAuth access token (Authorization Code + PKCE) or a user-created API key. A
token's effective permission is always `scopes ∩ access` — it can never exceed
what the owning member can do, on the clients and channels they can work on.

## Register (agents)

Clients register **dynamically** (RFC 7591) — no manual app setup. A client may instead skip
registration and use the HTTPS URL of its own **Client ID Metadata Document** as its `client_id`
(the AS metadata says `client_id_metadata_document_supported`; ChatGPT does this):

- Registration endpoint: `POST https://api.skedcast.com/oauth/register`
- Authorization endpoint: `https://api.skedcast.com/oauth/authorize`
- Token endpoint: `https://api.skedcast.com/oauth/token`
- JWKS: `https://api.skedcast.com/.well-known/jwks.json`

## Discovery

- Authorization server metadata (RFC 8414): `https://skedcast.com/.well-known/oauth-authorization-server` (mirrors `https://api.skedcast.com/.well-known/oauth-authorization-server`)
- Protected-resource metadata (RFC 9728): `https://skedcast.com/.well-known/oauth-protected-resource`
- MCP protected-resource metadata: `https://api.skedcast.com/.well-known/oauth-protected-resource/mcp`
- API catalog (RFC 9727): https://skedcast.com/.well-known/api-catalog

## Audience binding (RFC 8707)

Tokens are audience-bound. Request the resource you intend to call:

- REST API: `resource=https://api.skedcast.com/v1` at `/oauth/authorize` (revalidated at `/oauth/token` — `invalid_target` on mismatch).
- MCP server: `resource=https://api.skedcast.com/mcp` (the default when `resource` is omitted).

A token minted for one resource is rejected by the other.

## API keys (alternative)

Create a key in the SkedCast console → Settings → Developer, then send
`Authorization: Bearer sked_live_…`.

## Scopes

- `agency.read` — Read workspace profile
- `clients.read` — Read clients
- `accounts.read` — Read connected social accounts
- `posts.read` — Read posts and schedule
- `analytics.read` — Read analytics
- `reports.read` — Read reports
- `besttimes.read` — Read best-time recommendations
- `media.read` — Read content library
- `webhooks.read` — Read webhook endpoints and delivery logs
- `approvals.read` — Read the approval queue
- `campaigns.read` — Read campaigns
- `posts.compose` — Create and schedule posts
- `approvals.decide` — Approve or reject pending posts
- `media.manage` — Upload and manage library assets
- `clients.manage` — Create and manage clients
- `accounts.connect` — Generate account connect links
- `webhooks.manage` — Create and manage webhook endpoints
- `webhooks.delete` — Delete webhook endpoints
- `campaigns.manage` — Create and manage campaigns

Full developer reference: https://skedcast.com/developers · https://skedcast.com/developers/llms.txt