# Interfere auth.md

Agents connect to Interfere on behalf of a signed-in user. Access is limited to that user's existing workspace permissions.

## Connect with OAuth

1. Add `https://mcp.interfere.com/mcp` to an MCP client that supports OAuth.
2. Read [protected resource metadata](https://mcp.interfere.com/.well-known/oauth-protected-resource/mcp) to discover the authorization server and scopes.
3. Read [Clerk's authorization server metadata](https://clerk.interfere.com/.well-known/oauth-authorization-server). Clerk is the issuer; `interfere.com` is not an authorization server.
4. Follow the client's browser sign-in and consent flow. Request `interfere:access`, `user:org:read`, and `offline_access` as needed. Use authorization code with PKCE S256 and a client identity supported by the issuer's metadata.
5. Send the resulting access token in `Authorization: Bearer <access_token>` to the MCP endpoint. Never place tokens in URLs, prompts, source files, or logs.

For investigations, use `https://mcp.interfere.com/mcp/readonly` to reject write operations. Authenticate through the same issuer.

## Registration and credentials

Interfere does not offer anonymous agent registration, verified-email agent claiming, or ID-JAG provisioning. There is no separate `/agent/auth` endpoint or `agent_auth` registration contract. A user must authorize access through the supported OAuth client flow. Do not create accounts or register clients without the user's instruction.

The issuer's metadata advertises supported client authentication, client ID metadata documents, dynamic client registration, token refresh, and token revocation. Prefer a client ID metadata document when the client supports one. Otherwise, register a public client at the advertised `registration_endpoint`, requesting only the scopes above. Clerk always shows the user a consent screen for these clients.

The [public HTTP API schema](https://api.interfere.com/openapi.json) describes operation-specific authentication for telemetry and build uploads. Those credentials differ from MCP OAuth access tokens. See the [documentation](https://interfere.com/docs) for setup.