# MYOPL auth.md

Audience: agents reading public MYOPL references, and approved integration
operators connecting a signed MYOPL rules client.

## Public reference access

No registration, account, API key or bearer token is required for public
documentation or the public MCP reference tools. Use
`https://pickleball.myopl.net/api/v1/public/mcp` with MCP Streamable HTTP.
Follow the [connection guide](https://ai.myopl.net/integration.md) to initialize
the protocol and discover input schemas. Public access cannot perform account
actions or read private conversations and profiles.

## Agent registration and provisioning

Supported provisioning method for the separate A2A rules service: manual
approval and provisioning of a MYOPL signing client by the MYOPL operator.
The provisioning request page is [MYOPL Contact](https://myopl.net/contact/).
Select general questions and partnerships and describe the integration. A
contact request does not issue credentials or create an agent account.
Submitting a request sends a message, so an agent must obtain the user's
authorization before submitting it. Do not include secrets in the request.

There is no public automated registration, claim, verified-email, ID-JAG,
anonymous credential issuance, OAuth authorization server or OAuth token
endpoint advertised for this service. Do not invent those URLs or probe
`POST /agent/auth`. MYOPL's ordinary user signup is a separate product flow.

## Credential use

The [A2A card](https://ai.myopl.net/.well-known/agent-card.json) describes the
signed rules service at `https://pickleball.myopl.net/api/v1/agent`, using
JSON-RPC and A2A protocol 0.3 (`message/send`). Requests require
`X-AI-Client-ID`, `X-AI-Timestamp`, `X-AI-Nonce` and `X-AI-Signature` according
to the signing instructions supplied when a client is provisioned. Do not use
these credentials for the public MCP endpoint. Store signing secrets only in
the integration's secret manager, never in browser code or chat.

For lost or revoked credentials, contact the MYOPL operator through the same
provisioning request page. No public revocation endpoint or webhook event is
advertised. An anonymous access denial from the signed A2A endpoint is expected;
use public MCP or HTML resources when signed access has not been provisioned.

[Español](https://ai.myopl.net/auth.es.md)