# auth.md

Agent authentication guide for Create Prints.

Create Prints exposes an MCP server for AI agents (Claude, and any MCP-compatible
client) at:

```
https://mcp.createprints.ai/mcp
```

Access is protected by standard OAuth 2.0 with PKCE. There is nothing
Create-Prints-specific to implement beyond standard OAuth discovery — an
agent that already speaks OAuth 2.0 Authorization Code + PKCE and MCP's
protected-resource-metadata convention can connect without prior
registration.

## Discovery

1. Request the MCP endpoint without a token. It responds `401` with:

   ```
   WWW-Authenticate: Bearer resource_metadata="https://mcp.createprints.ai/.well-known/oauth-protected-resource/mcp"
   ```

2. Fetch that URL (RFC 9728, OAuth Protected Resource Metadata):

   ```json
   {
     "resource": "https://mcp.createprints.ai/mcp",
     "authorization_servers": ["https://api.createprints.ai"],
     "scopes_supported": [
       "print_options:read", "artwork:create", "artwork:read",
       "checkout:create", "checkout:read", "orders:read", "fulfillment:retry"
     ]
   }
   ```

3. Fetch the authorization server's metadata (RFC 8414), which also
   includes an `agent_auth` block ([Auth.md](https://workos.com/auth-md)
   convention) pointing back here and declaring `identity_types_supported:
   ["service_auth"]` — Create Prints registers agents as standard OAuth
   clients (step 1 of Registration below), not via identity-assertion or
   anonymous flows:

   ```
   GET https://api.createprints.ai/.well-known/oauth-authorization-server
   ```

## Registration

The authorization server supports OAuth 2.0 Dynamic Client Registration
(RFC 7591) at `registration_endpoint`
(`https://api.createprints.ai/api/oauth/register`). No manual sign-up or
API key is required — register your client at connection time.

## Authorization flow

Standard Authorization Code grant with PKCE (`S256` only,
`token_endpoint_auth_methods_supported: ["none"]` — public clients, no
client secret):

1. `POST /api/oauth/register` — dynamic client registration.
2. Redirect the user to `authorization_endpoint`
   (`https://api.createprints.ai/api/oauth/authorize`) with the usual
   `client_id`, `redirect_uri`, `code_challenge` (`S256`), `state`, `scope`,
   and `resource` parameters. The user signs in with their Create Prints
   account and approves the requested scopes.
3. Exchange the returned code at `token_endpoint`
   (`https://api.createprints.ai/api/oauth/token`) for an access token
   (`grant_types_supported`: `authorization_code`, `refresh_token`).
4. Call MCP tools with `Authorization: Bearer <token>`.

## Scopes

| Scope | Grants |
|---|---|
| `print_options:read` | View available print sizes and options |
| `artwork:create` | Generate artwork using the user's credits |
| `artwork:read` | View the user's generated artwork |
| `checkout:create` | Create print purchase checkouts |
| `checkout:read` | View checkout/order status |
| `orders:read` | View the user's order status |
| `fulfillment:retry` | Retry stuck order fulfilment |

Agents never see payment details — checkout creates a Stripe-hosted link
that the human completes in their own browser.

## Revocation

Call `revocation_endpoint` (`https://api.createprints.ai/api/mcp/revoke`,
`POST { "token": "<access_or_refresh_token>" }`) to revoke a session —
either token immediately revokes the whole session. Well-behaved MCP
clients should call this when a user disconnects the integration from the
client's own settings. There is currently no self-service "connected apps"
page in the Create Prints account UI; email support@createprints.ai to
have a specific session revoked in the meantime.

## Human-facing docs

See [/mcp/connect](https://www.createprints.ai/mcp/connect) for the
end-user connection guide (Claude Desktop / Claude Code / Claude.ai setup
instructions and the full tool list).