# auth.md

Authentication for Answering Service Care (ASC). You are an agent: this page says how to get access to each ASC surface. There are five, and only two need credentials. ASC does not support agentic self-registration: a person signs in and approves access.

## Discover

| Surface | What it's for | Credential |
|---|---|---|
| Public API, https://answeringservicecare.com/api/v1 | Company facts, services, pricing, site search | None (anonymous) |
| Public MCP server, https://answeringservicecare.com/mcp | The same facts as read-only MCP tools | None (anonymous) |
| Docs MCP server, https://answeringservicecare.com/docs/~gitbook/mcp | Search and read the documentation, including the customer API reference | None (anonymous) |
| MCP server, https://mcp.answeringservicecare.com/api/v2/mcp | ASC account tools for MCP clients | OAuth 2.0 access token |
| Customer REST API | Messages, call recordings, to-dos for existing customers | Issued to ASC customers |

Machine-readable entry points:

- OpenAPI: https://answeringservicecare.com/openapi.json
- API catalog: https://answeringservicecare.com/.well-known/api-catalog
- MCP server protected-resource metadata (RFC 9728): https://mcp.answeringservicecare.com/.well-known/oauth-protected-resource
- MCP authorization-server metadata (RFC 8414): https://mcp.answeringservicecare.com/.well-known/oauth-authorization-server

Copies of both documents are also published at https://answeringservicecare.com/.well-known/oauth-protected-resource and https://answeringservicecare.com/.well-known/oauth-authorization-server for discovery from this site's origin. When authenticating, use the ones on https://mcp.answeringservicecare.com above, since their `issuer` and `resource` identifiers match that host.

An unauthenticated request to the MCP server returns `401` with a `WWW-Authenticate: Bearer` header whose `resource_metadata` parameter points to the protected-resource metadata.

## Pick a method

- Facts about ASC (plans, prices, services, contact details, site search): the public API or the public MCP server. No credentials.
- ASC documentation, including the customer API reference: the docs MCP server. No credentials.
- A customer's own account data from an MCP client: the MCP server, with OAuth 2.0 (authorization code with PKCE).
- A customer's own account data over REST: the customer REST API, with credentials ASC issues to the customer. Its request format and authentication scheme are in the API reference: https://answeringservicecare.com/docs/api-reference/

The public API needs nothing: every operation is a read-only `GET`, and you shouldn't send an `Authorization` header.

```
curl https://answeringservicecare.com/api/v1/pricing
```

## Register

An agent can't create an ASC account or customer credentials itself; ask the user to provide them, or send them to the pricing or contact page. The authorization server publishes no `agent_auth` block, so the auth.md agent registration flows (identity assertion, verified email, anonymous claim) aren't available.

When the authorization-server metadata lists a `registration_endpoint`, an MCP client that has no client ID for the MCP server can register one there (RFC 7591 dynamic client registration). That registers the client software, not an account: a person still signs in and approves access.

## Authorize

1. Fetch the protected-resource metadata and read `authorization_servers`.
2. Fetch that server's metadata from `/.well-known/oauth-authorization-server` on its origin.
3. Run the authorization-code flow it describes, with PKCE (`S256`), asking only for the scopes you need from `scopes_supported`. A person signs in and approves access; the agent can't approve on their behalf.
4. Exchange the code at the `token_endpoint`. When the access token expires, use the `refresh_token` grant.

## Use the access_token

Call the MCP server with `Authorization: Bearer <access_token>`. The tool list is only available after authorization.

## Errors

- Public API errors are JSON: `code`, `message`, `hint`, and `documentation_url`. Follow the `hint`.
- A `401` from the MCP server means the token is missing or expired. Refresh it, or run the authorization flow again; the `WWW-Authenticate` header points back to the protected-resource metadata.

## Revocation

To end an agent's access to an ASC account, the account holder can contact ASC. Public API access needs no revocation because it grants no account access.

Contact: https://answeringservicecare.com/contact-us/