# auth.md: Authentication for Agents

VIA runs an OAuth 2.1 authorization server for user-linked access (the VIA
plugin in ChatGPT and other MCP clients). Machine-readable metadata:
`/.well-known/oauth-authorization-server` and
`/.well-known/oauth-protected-resource/shop/mcp` (and `/chatgpt/mcp`).

## Endpoints

- Issuer: `https://app.getvia.xyz`
- Authorization: `https://app.getvia.xyz/api/oauth/authorize`
- Token: `https://app.getvia.xyz/api/oauth/token`
- Dynamic client registration: `https://app.getvia.xyz/api/oauth/register`
- Revocation: `https://app.getvia.xyz/api/oauth/revoke`

## Flow

- Grant types: `authorization_code` with PKCE (S256 only) and `refresh_token`.
- Public clients (token endpoint auth `none`). Clients identify with a Client ID
  Metadata Document (any public https host) or by dynamic client registration.
- Authorization responses include `iss` (RFC 9207).
- Access tokens last one hour; refresh tokens rotate on use.

## Scopes

- `via.shop` use the signed-in buyer's VIA shopper: Taste Card, watches, finds.
  It cannot buy or spend.

## MCP

- `https://app.getvia.xyz/shop/mcp`: the VIA shopper MCP for any assistant
  (Claude, ChatGPT, Gemini, Le Chat, Grok, Perplexity). Product search is open;
  personal tools need a `via.shop` bearer token. `/chatgpt/mcp` is the same
  server under the address in the ChatGPT directory package.
- `https://app.getvia.xyz/mcp`: the network MCP (open discovery; purchases
  settle per tool, see its tool descriptions). Per-seller servers are at
  `/sellers/{slug}/mcp`, per-buyer at `/buyers/{handle}/mcp`.

## Privacy

https://www.getvia.xyz/trust