# auth.md

Agent registration and authentication discovery for **Ever Legacy**.

## Audience

Ever Legacy is a digital inheritance vault for humans. Public discovery endpoints (health, OpenAPI, MCP overview tools, llms.txt) do not require authentication. Private vault, beneficiary, and billing APIs require an authenticated human browser session and are **not** available for third-party agent automation.

## Human registration

- Web sign-up: https://everlegacy.app/auth/register
- API registration: POST https://everlegacy.app/api/auth/register with email and password
- Google OAuth sign-in: https://everlegacy.app/api/auth/signin/google

## OAuth discovery

- Authorization server metadata: https://everlegacy.app/.well-known/oauth-authorization-server
- OpenID configuration: https://everlegacy.app/.well-known/openid-configuration
- Protected resource metadata: https://everlegacy.app/.well-known/oauth-protected-resource

## Agent guidance

1. Prefer unauthenticated public discovery documents listed above.
2. For account creation on behalf of a user, use the human registration flows and obtain explicit user consent.
3. Do not attempt to access `/api/assets`, `/api/beneficiaries`, or other vault routes without a user-authorized session.
4. Contact support@everlegacy.app for partnership or agent-integration requests.

## Scopes

| Scope | Description |
| --- | --- |
| `openid` | OpenID subject identifier |
| `profile` | Display name |
| `email` | Email address |

## Related

- API docs: https://everlegacy.app/docs/api
- MCP server card: https://everlegacy.app/.well-known/mcp/server-card.json
- Support: https://everlegacy.app/support