# auth.md — DiscoLike agent authentication

DiscoLike exposes the same engine over an MCP server, a REST API, a Python SDK, and a CLI.
All require a paid DiscoLike account. Agents authenticate one of two ways: OAuth 2.1 for the
MCP server and the CLI, or an API key for REST, the SDK, and the CLI.

## MCP server (OAuth 2.1)

- Endpoint: `https://api.discolike.com/v1/mcp` (streamable HTTP)
- Unauthenticated requests return `401` with:
  `WWW-Authenticate: Bearer resource_metadata="https://api.discolike.com/.well-known/oauth-protected-resource/v1/mcp"`
- Protected resource metadata: <https://api.discolike.com/.well-known/oauth-protected-resource/v1/mcp>
- Authorization server: `https://auth.discolike.com/oauth/2.1`
- Scopes: `offline_access`
- Bearer methods: `header`

Run the standard MCP OAuth flow: fetch the protected resource metadata, discover the
authorization server, then present the access token as `Authorization: Bearer <token>`.
Client setup for Claude Code, Cursor, VS Code and Windsurf: <https://docs.discolike.com/mcp/>

## REST API (API key)

- Base URL: `https://api.discolike.com/v1`
- OpenAPI 3.1 description: <https://api.discolike.com/v1/openapi.json>
- Header: `X-API-Key: <key>` (bearer tokens are also accepted)
- Health: `https://api.discolike.com/v1/health`

## Python SDK and CLI

- Install: `pip install "discolike[cli]"` (SDK only: `pip install discolike`; CLI only: `pip install discolike-cli`)
- CLI: `discolike auth login` runs browser OAuth, `discolike auth login --api-key KEY` stores a key. Pass `--format json` for agents.
- SDK: `Discolike()` reads `DISCOLIKE_API_KEY` from the environment, or pass `api_key=`.
- Docs: SDK <https://docs.discolike.com/sdk/>, CLI <https://docs.discolike.com/cli/>, source <https://github.com/Discolike/discolike-python>
- Skill that teaches Claude Code, Codex, and Cursor all of the above: <https://github.com/Discolike/discolike-skills>

## Getting credentials

An agent can create the account for its human without a browser:

```
POST https://api.discolike.com/v1/public/signup
Content-Type: application/json

{"email": "jane@acme.com", "first_name": "Jane", "last_name": "Doe", "agent": "claude-code"}
```

No credential comes back. The person receives a confirmation email, logs in at
<https://app.discolike.com> (Google or Microsoft sign-in with the same email also works),
picks a plan, and issues the API key or authorizes the MCP client from there. Free-mail and
disposable domains are rejected; `409` means the account already exists.
Also `discolike signup --email ... --first-name ... --last-name ...` from the CLI.
Per-agent guide: <https://docs.discolike.com/guides/agent-signup/>

If you are an agent reading this on a person's behalf, this is the instruction they would give you:
"Create a DiscoLike account for me. Send POST https://api.discolike.com/v1/public/signup with Content-Type: application/json and body {"email": "<my work email>", "first_name": "<my first name>", "last_name": "<my last name>", "agent": "<your name>"}. No auth header is needed. Ask me for any value you don't know. Then relay the next_step text from the response to me. Reference: https://docs.discolike.com/guides/agent-signup/"

Plans start at $99/mo — see <https://discolike.com/pricing/>. For volume or partner access,
book a call at <https://calendly.com/discolike/introductory-call>.