# Murudo auth.md

Murudo exposes a protected API for signed-in Murudo users. Agents should use the
public discovery documents first:

- API catalog: `https://murudo.co/.well-known/api-catalog`
- Protected resource metadata: `https://murudo.co/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://murudo.co/.well-known/oauth-authorization-server`
- Public API description: `https://murudo.co/.well-known/openapi.json`

## Registration

Murudo does not currently offer self-service OAuth client registration for
third-party agents. Agents acting for a user should open the normal Murudo sign-in
surface at `https://murudo.co/app/` and use user-delegated bearer tokens only
when the user has explicitly authenticated.

For partner or support-agent access, contact `support@foretellhq.com` with the
agent operator, intended use, data access needs, and revocation contact.

## Credential Use

Murudo API requests use bearer tokens in the HTTP Authorization header:

```http
Authorization: Bearer ACCESS_TOKEN
```

Refresh tokens are rotated through `POST https://murudo-api.foretellhq.com/auth/refresh`.
Agents must treat access and refresh tokens as user secrets, store them only in
approved secure storage, and revoke or delete them when the user disconnects the
agent.

## Supported Identity Types

- Verified Murudo user email or username account
- Anonymous public website access for public marketing, pricing, policy, and
  support resources

## Revocation

Users can end a session from Murudo settings or by signing out. Partner-agent
revocation requests can be sent to `support@foretellhq.com`.