# Agent authentication — Help Me Find A Doctor

This site publishes an MCP server and a small set of public JSON APIs. This
document describes how automated agents should register and authenticate.

## Endpoints

- MCP endpoint: https://helpmefindadoctor.com/mcp (Streamable HTTP, MCP spec 2025-06-18)
- MCP Server Card: https://helpmefindadoctor.com/.well-known/mcp.json
- Skills index: https://helpmefindadoctor.com/.well-known/agent-skills.json
- API catalog (RFC 9727): https://helpmefindadoctor.com/.well-known/api-catalog
- OAuth Protected Resource Metadata (RFC 9728): https://helpmefindadoctor.com/.well-known/oauth-protected-resource
- OAuth Authorization Server Metadata (RFC 8414): https://helpmefindadoctor.com/.well-known/oauth-authorization-server
- OpenID Connect Discovery: https://helpmefindadoctor.com/.well-known/openid-configuration

## Authentication

The MCP server is an OAuth 2.1 protected resource. The authorization server is
Supabase Auth at `https://xzlmnbbrdkauinekexoi.supabase.co/auth/v1`. Dynamic Client Registration (RFC 7591) is
enabled so MCP clients such as Claude, ChatGPT, Codex, and Cursor can register
themselves automatically.

Flow:
1. GET https://helpmefindadoctor.com/.well-known/oauth-protected-resource to discover the
   authorization server URL and accepted audiences.
2. GET https://helpmefindadoctor.com/.well-known/oauth-authorization-server to discover
   authorize/token/registration endpoints.
3. Perform DCR at the `registration_endpoint` if the client is not
   pre-registered.
4. Run the OAuth 2.1 Authorization Code + PKCE flow. The end user consents at
   https://helpmefindadoctor.com/.lovable/oauth/consent.
5. Present the resulting bearer token to https://helpmefindadoctor.com/mcp on every request.

Accepted token audience: `authenticated`. Tokens must be signed by the
issuer above (RFC 8414 issuer match is enforced).

## Public (unauthenticated) endpoints

These do not require OAuth:

- https://helpmefindadoctor.com/api/public/cities/index.json
- https://helpmefindadoctor.com/api/public/cities/{ST}/{slug}.json
- https://helpmefindadoctor.com/api/public/city-data-version.json
- https://helpmefindadoctor.com/sitemap.xml, /sitemap-index.xml, /sitemap-doctors.xml, /sitemap-concierge.xml
- https://helpmefindadoctor.com/robots.txt, /llms.txt

Rate limits apply. Automated scraping outside the published APIs is prohibited
by our Terms of Use (https://helpmefindadoctor.com/terms). Report abuse or coordinate elevated
access at abuse@helpmefindadoctor.com.

## Agent identification

Send a descriptive `User-Agent` header including a contact URL or email.
Example: `ExampleBot/1.0 (+https://example.com/bot)`.