# auth.md for indumás

indumás (https://indumas.com) exposes a Model Context Protocol (MCP) server at https://api.indumas.com/mcp.
It needs the user's indumás account, which is free: OAuth 2.1 with PKCE, authorized once by the person in their
browser. There are no API keys. Every tool reads indumás's public catalog, what any visitor of the site sees, without
the companies' contacts, and nothing can change it.
Human documentation: https://indumas.com/docs/mcp

## Getting a token

1. `POST https://api.indumas.com/mcp` without a token answers 401 with
   `WWW-Authenticate: Bearer resource_metadata="https://api.indumas.com/.well-known/oauth-protected-resource/mcp"` (RFC 9728).
2. That document names the authorization server, https://indumas.com/api/oauth; its metadata is at
   https://indumas.com/.well-known/oauth-authorization-server/api/oauth (RFC 8414).
3. Register the client: `POST https://indumas.com/api/oauth/register` (RFC 7591), public (`token_endpoint_auth_method: "none"`)
   with https, loopback or app redirect URIs.
4. Send the person to `https://indumas.com/api/oauth/authorize` with PKCE (S256), `scope=catalog:read` and
   `resource=https://api.indumas.com/mcp`. indumás shows them a page to sign in and authorize; the redirect brings back a code.
5. Exchange it at `https://indumas.com/api/oauth/token`: an access token (an hour) and a refresh token (30 days, rotated on use).
   Send `Authorization: Bearer <token>` with every call.

## Connecting

Send JSON-RPC to https://api.indumas.com/mcp over Streamable HTTP: POST, with
`Accept: application/json, text/event-stream` and `Content-Type: application/json`. The server is stateless:
`initialize` is optional, there is no session, and GET and DELETE answer 405.

## Limits

Calls are limited per account, per minute and per day, and per connection. Over a minute's limit a tool answers
`rate_limited: ...` (wait a minute); over the day's, `limit_reached: ...` (tell the user; indumas.com has the same
catalog).

## Data

Published companies and organizations only: never tax ID numbers, accounts, or companies indumás hasn't verified, and
never a company's contacts (they're on its indumás page, behind «Ver contacto»). Company descriptions, taglines and
products are written by the companies themselves.

## Discovery

- Server card: https://api.indumas.com/mcp/server-card
- AI catalog: https://indumas.com/.well-known/ai-catalog.json
- API catalog: https://indumas.com/.well-known/api-catalog