# rrule.net auth.md

rrule.net supports human-assisted OAuth client provisioning for AI agents and
machine-to-machine clients. Public schedule validation, simulation, and
description through the MCP server do not require authentication. Persistent
hosted schedule operations require credentials created by the user.

rrule.net does not currently support autonomous account creation or dynamic client registration.
Identity-assertion registration, anonymous credentials, and Auth.md claim
ceremonies are also unsupported. Do not call guessed registration endpoints or
claim that setup is complete before the user confirms it.

## Discover the resources

- REST API protected-resource metadata:
  https://api.rrule.net/.well-known/oauth-protected-resource
- MCP protected-resource metadata:
  https://mcp.rrule.net/.well-known/oauth-protected-resource
- Authorization-server metadata:
  https://rrule.net/.well-known/oauth-authorization-server
- MCP documentation: https://rrule.net/docs/mcp
- REST API documentation: https://rrule.net/docs/api

Use the exact `resource` value returned by the protected-resource metadata.
Tokens are audience-bound and must not be sent to the other resource.

## Ask the user to provision credentials

1. Ask the user to create an account or sign in at https://rrule.net/login.
2. Ask the user to create an OAuth client at
   https://rrule.net/dashboard/oauth.
3. Tell the user that the client secret is displayed once. They must copy it
   directly into the agent or MCP client's secure credential store, never into
   a prompt, conversation, log, or tool argument.
4. Wait for the user to confirm that credential setup is complete.

Client creation and revocation remain user-controlled dashboard operations.

## Request a token

Send an `application/x-www-form-urlencoded` request to
https://api.rrule.net/oauth/token with:

- `grant_type=client_credentials`
- the provisioned `client_id`
- the provisioned `client_secret`
- `resource=https://mcp.rrule.net` for MCP tools, or
  `resource=https://api.rrule.net` for direct REST API calls
- the minimum required `scope`, separated by spaces

Supported scopes:

- `schedules:read` lists schedules, reads one schedule, and inspects execution
  history;
- `schedules:write` creates, updates, pauses, resumes, and deletes schedules.

The response is a standard Bearer token response. Store the access token in
memory or secure credential storage and renew it through the same client
credentials flow when it expires.

## Use credentials safely

Send the access token only as an HTTP header:

```http
Authorization: Bearer <access_token>
```

Follow `WWW-Authenticate` challenges and their `resource_metadata` URL. Never
put a client secret or access token in a schedule definition, webhook payload,
MCP tool argument, URL, or user-visible answer.

Before a destructive hosted operation, especially `delete_schedule`, obtain
the user's explicit confirmation immediately before the call.

## Revoke access

rrule.net does not expose an OAuth token-revocation endpoint. The user can
revoke the OAuth client at https://rrule.net/dashboard/oauth. After revocation,
discard the client secret and all access tokens issued to that client.