# auth.md

## Overview

GotCashback's public agent-facing interfaces are anonymous and read-only:

- REST API: <https://api.gotcashback.com> (OpenAPI: <https://api.gotcashback.com/swagger/v1/swagger.json>)
- MCP server: <https://mcp.gotcashback.com> (Streamable HTTP)

No authentication, API key, or registration is required for the public
comparison data (stores, cashback rates, gift cards, portals, countries).

In addition, the MCP server exposes optional per-user tools (profile,
favorite stores, cashback/gift card alerts) protected by OAuth 2.1.

## OAuth 2.1 (optional, per-user MCP tools only)

- Authorization server: <https://www.gotcashback.com/> —
  metadata at `/.well-known/oauth-authorization-server`
- Protected resource metadata:
  <https://mcp.gotcashback.com/.well-known/oauth-protected-resource>
- Dynamic client registration (RFC 7591): `POST /connect/register`
  (public clients only, `token_endpoint_auth_method: "none"`)
- Authorization code flow with PKCE (S256) required; refresh tokens supported
- End-user sign-in uses GotCashback's interactive social login
- Scopes: `profile`, `favorites`, `alerts` (plus `offline_access` for refresh tokens)

Calling a per-user MCP tool without a bearer token returns HTTP 401 with a
`WWW-Authenticate` challenge referencing the protected resource metadata.

## Agent Registration

Not required for public data. For per-user tools, register a client via the
dynamic client registration endpoint above. Use is subject to fair use and
the terms at <https://www.gotcashback.com/Terms/>.

## Contact

<support@gotcashback.com>