# White Shoe authentication discovery

Canonical authentication instructions: https://app.white-shoe.ai/auth.md

This file is a public compatibility pointer from the White Shoe marketing site. The marketing origin, https://whiteshoe.ai, publishes only read-only public information. It never receives credentials, issues tokens, or serves the protected application API.

## OAuth-protected MCP resource

- MCP transport: https://app.white-shoe.ai/api/mcp
- MCP Server Card: https://app.white-shoe.ai/api/mcp/server-card
- RFC 9728 protected-resource metadata: https://app.white-shoe.ai/.well-known/oauth-protected-resource/api/mcp
- RFC 8414 authorization-server metadata: https://app.white-shoe.ai/.well-known/oauth-authorization-server
- Flow: OAuth 2.0 authorization code with PKCE S256 and rotating refresh tokens
- Scopes: `mcp.read`, `mcp.write`, and `mcp.jobs`

Use the metadata documents above to discover registration, authorization, and token endpoints. Send credentials and bearer tokens only to the HTTPS endpoints advertised by app.white-shoe.ai.

## Protocol boundaries

- OAuth dynamic client registration registers an MCP client; it is not agent-identity registration.
- White Shoe does not advertise OpenID Connect or issue ID tokens.
- White Shoe does not implement the WorkOS `agent_auth` block, ID-JAG identity assertions, claim ceremonies, or revocation-event flows.
- White Shoe does not advertise an Agent2Agent (A2A) service or Agent Card.

For current details and redirect-URI requirements, use the canonical document at https://app.white-shoe.ai/auth.md.