# Repurai auth.md

How AI agents and scripts get access to a Repurai user's account: the MCP server (https://repurai.com/api/mcp) and the REST API (https://repurai.com/api/v1).

## Who this is for

Agents acting for a Repurai user who wants them to read their feeds, posts, summaries, transcripts or Post Automation drafts. Access needs a paid plan (Starter or above).

## Method 1: OAuth 2.1 (for AI apps and MCP clients)

Repurai is an OAuth 2.1 authorization server. Apps register themselves and the user approves them; no secret is shared.

1. Discover: https://repurai.com/.well-known/oauth-protected-resource/api/mcp names the authorization server; its metadata is at https://repurai.com/.well-known/oauth-authorization-server.
2. Register: `POST https://repurai.com/api/auth/oauth2/register` (RFC 7591 dynamic client registration; public clients use `token_endpoint_auth_method: "none"`).
3. Authorize: send the user to `https://repurai.com/api/auth/oauth2/authorize` with PKCE (S256) and `resource=https://repurai.com/api/mcp`. They sign in and approve on Repurai's consent screen.
4. Exchange the code at `https://repurai.com/api/auth/oauth2/token` for a short-lived access token (and a refresh token with `offline_access`).
5. Call the MCP server or the REST API with `Authorization: Bearer <access token>`.

## Method 2: API key (for scripts the user runs)

1. The user signs in at https://repurai.com/signin (or creates an account at https://repurai.com/signup).
2. They open https://repurai.com/dashboard/api-keys and create a key. Keys start with `rep_`.
3. Send it on every request:

```
Authorization: Bearer rep_your_api_key
```

## Using the credential

- Either credential carries the access of the user who granted it, within their plan's limits (monthly API calls, AI summaries).
- `401` means the credential is missing, wrong, expired or revoked; the MCP server's `WWW-Authenticate` header points to the resource metadata. `403` means the plan does not include that feature or a limit was reached.
- Treat tokens and keys as secrets: never log them or put them in URLs. The user can revoke API keys at any time.

Reference: https://repurai.com/docs/authentication · OpenAPI: https://repurai.com/openapi.json · MCP Server Card: https://repurai.com/.well-known/mcp/server-card.json · Agent skill: https://repurai.com/.well-known/agent-skills/repurai-api/SKILL.md