# LeaseLineage auth.md

## Agent audience

This flow is for AI agents and developer tools that need read-only access to the LeaseLineage public CRE MCP server. It does not grant access to private product data.

## Registration

Register an OAuth public client by sending JSON to:

POST https://app.leaselineage.com/agent/auth
Content-Type: application/json

```json
{
  "client_name": "Your agent name",
  "redirect_uris": ["https://agent.example/callback"]
}
```

The response returns a `client_id`. Clients are public and do not receive a client secret. HTTPS redirect URIs are required, except loopback HTTP redirects for local development.

## Authorization method

Use OAuth 2.0 Authorization Code with PKCE S256:

1. Read authorization metadata at https://app.leaselineage.com/.well-known/oauth-authorization-server.
2. Send the human user to https://app.leaselineage.com/oauth/authorize with `response_type=code`, your `client_id`, exact registered `redirect_uri`, `scope=mcp.read`, `state`, `code_challenge`, and `code_challenge_method=S256`.
3. The signed-in user reviews and approves read-only access.
4. Exchange the returned code at https://app.leaselineage.com/oauth/token using `grant_type=authorization_code`, `client_id`, `redirect_uri`, and `code_verifier`.
5. Send the access token as `Authorization: Bearer TOKEN` to https://app.leaselineage.com/mcp.

Tokens expire after one hour. Registration credentials expire after one year. The only supported scope is `mcp.read`.

## Discovery

- Protected Resource Metadata: https://app.leaselineage.com/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://app.leaselineage.com/.well-known/oauth-authorization-server
- MCP Server Card: https://app.leaselineage.com/.well-known/mcp/server-card.json
- MCP endpoint: https://app.leaselineage.com/mcp

## Permission boundary

The token authorizes only public listing search, public broker search, and public CRE resources. It cannot access contacts, campaigns, connected inboxes, tenant inquiries, billing, reporting, or account settings.

## Human access

Human users can sign in at https://app.leaselineage.com/login or create an account at https://app.leaselineage.com/register. Product access uses a browser session and is governed by the published terms and privacy policy.