# auth.md

AI TRAN (leolion) exposes an authenticated EmDash MCP endpoint for AI agents.

## Agent audience

Agents that help draft, edit, organize, or publish blog content may request access.

## Resource

- MCP endpoint: https://leolion.naai.studio/_emdash/api/mcp
- OAuth protected resource metadata: https://leolion.naai.studio/.well-known/oauth-protected-resource
- OAuth authorization server metadata: https://leolion.naai.studio/.well-known/oauth-authorization-server
- Issuer: https://leolion.naai.studio/_emdash

## Registration

OAuth public clients can use dynamic registration at:

```text
https://leolion.naai.studio/_emdash/api/oauth/register
```

The authorization server supports Authorization Code with PKCE and Device Authorization Grant. API tokens can also be created by an authenticated admin inside EmDash.

## Credential use

Send bearer tokens in the HTTP Authorization header:

```http
Authorization: Bearer <token>
```

## Scopes

- `content:read`
- `content:write`
- `media:read`
- `media:write`
- `schema:read`
- `schema:write`
- `taxonomies:manage`
- `menus:manage`
- `settings:read`
- `settings:manage`
- `admin`

## Revocation

OAuth tokens can be revoked at:

```text
https://leolion.naai.studio/_emdash/api/oauth/token/revoke
```