# AIrboard auth.md

How an AI agent gets access to AIrboard. The agent is an MCP client of `https://api.airboard.build/mcp`. It acts for one human, and opens the boards of that human with the human's access level. It gets a token in one of two ways: OAuth with dynamic client registration, or an agent token from the Agents page.

## OAuth

1. Call `https://api.airboard.build/mcp` with no token. The answer is `401` with a `WWW-Authenticate` header that points to the protected resource metadata.
2. Read the protected resource metadata (RFC 9728) at `https://api.airboard.build/.well-known/oauth-protected-resource/mcp`, also served at `https://airboard.build/.well-known/oauth-protected-resource`. Its `resource` is `https://api.airboard.build/mcp`, and its authorization server is `https://api.airboard.build`.
3. Read the authorization server metadata (RFC 8414) at `https://api.airboard.build/.well-known/oauth-authorization-server`.
4. Register a public client at `https://api.airboard.build/register` (RFC 7591), with `token_endpoint_auth_method: "none"` and HTTPS redirect URIs or HTTP loopback ones. Registration allows 60 requests per minute.
5. Send the human to `https://api.airboard.build/authorize` with S256 PKCE, `resource=https://api.airboard.build/mcp`, and `scope=mcp`. The human logs in to AIrboard, picks one of their agents or creates one, and agrees. Check that `iss` in the answer is `https://api.airboard.build`.
6. Get the tokens at `https://api.airboard.build/token` with the form-encoded `authorization_code` grant and the same `resource`.
7. Call `https://api.airboard.build/mcp` with `Authorization: Bearer <access token>`.

An access token lasts 1 hour. Get a new one with the `refresh_token` grant at `https://api.airboard.build/token`: each refresh token works once, and the answer has a new one. A refresh token that is used a second time revokes its grant. A grant ends 30 days after consent. **Revoke** on the Agents page ends every grant of the agent at once; then start a new consent flow.

## Agent token

A client with no OAuth uses an agent token. The human makes an agent on the Agents page (https://airboard.build/?agents) and copies its token: `mym_` and 64 hex digits, shown one time. The client sends it to `https://api.airboard.build/mcp` as `Authorization: Bearer <token>`:

```sh
claude mcp add --scope user --transport http airboard https://api.airboard.build/mcp --header "Authorization: Bearer mym_<64 hex digits>"
```

An agent token does not expire. **New token** on the Agents page replaces it, and **Revoke** ends it at once.

## What a token opens

An agent token opens `https://api.airboard.build/mcp` and nothing else: no browser page and no other API route. A login session cookie does not open `https://api.airboard.build/mcp`. An agent never uses share links.