# Agent authentication for Intervixa AI

Intervixa AI exposes its tools through a remote MCP server. Agents act on behalf of a
signed-in Intervixa AI user; there is no machine-only credential.

## Endpoints

- MCP endpoint: `https://ihyxemjksxwuovdabjxu.supabase.co/functions/v1/mcp`
- Protected resource metadata: `https://intervixa.online/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://intervixa.online/.well-known/oauth-authorization-server`
- Issuer: `https://ihyxemjksxwuovdabjxu.supabase.co/auth/v1`

## How to connect

1. Register your client dynamically (RFC 7591) at the registration endpoint published in the
   authorization server metadata. No pre-shared client secret is required; public clients using
   PKCE (`S256`) are supported.
2. Send the user through the authorization endpoint. They sign in with their Intervixa AI account
   (email/password or Google) and approve the connection on the consent screen.
3. Exchange the authorization code for an access token at the token endpoint.
4. Call the MCP endpoint with `Authorization: Bearer <access_token>` and
   `Accept: application/json, text/event-stream`.

Tokens are scoped to the individual user; all data access is row-level-security enforced as that
user. Copied app session tokens are rejected — only tokens issued to a registered OAuth client work.

## Human help

Connection walkthroughs for ChatGPT, Claude and other MCP clients live at
<https://intervixa.online/>.