# SVG Genie Auth.md

SVG Genie's hosted MCP server is available at `https://www.svggenie.com/mcp`.

## OAuth 2.1

MCP clients should begin with the protected-resource metadata at:

`https://www.svggenie.com/.well-known/oauth-protected-resource`

SVG Genie supports OAuth 2.1 authorization code flow with PKCE and dynamic client registration through its authorization server. Send the resulting access token on every MCP request:

```http
Authorization: Bearer <access-token>
```

The server returns an HTTP 401 response with a `WWW-Authenticate` resource metadata challenge when authentication is missing or invalid.

### Agent registration

Agents register an OAuth client using the `registration_endpoint` advertised by:

`https://www.svggenie.com/.well-known/oauth-authorization-server`

The supported agent identity method is a `verified_email` identity assertion completed through SVG Genie's OAuth authorization and consent flow. Registration produces OAuth client credentials; the agent then starts authorization code flow with PKCE and asks the user to sign in and approve access on SVG Genie's consent screen. The authorization endpoint is the claim URI, and successful token exchange returns an `oauth2_access_token`.

SVG Genie's authorization-server metadata is the first-party discovery surface. Token issuance, client registration, and user authorization are delegated to the SVG Genie Supabase Auth project; the metadata exposes those upstream endpoints directly.

## SVG Genie API keys

Signed-in users may create a first-party API key in the SVG Genie dashboard. API keys begin with `sgak_` and use the same Bearer header. Treat keys like passwords: do not place them in URLs, browser code, logs, or source control.

## Endpoint

The MCP endpoint uses the Streamable HTTP transport:

```
https://www.svggenie.com/mcp
```