# Larkspur Ops auth.md

How AI agents and automation get credentials for the Larkspur Freight ops console.

## Who this is for

Agents acting for Larkspur staff or integration partners: dispatch bots, on-call assistants, reporting jobs.

## Register

`POST https://decoy.day/agent/auth` with JSON:

```json
{ "agent_name": "dispatch-helper", "operator": "team or person responsible", "purpose": "what the agent will do" }
```

The response carries a `client_id` and an `api_key`. During the current maintenance window registrations are approved automatically (method: `anonymous`, no email verification).

## Use the key

Send it as a bearer token:

- MCP console (Streamable HTTP): `https://mcp.decoy.day/mcp`. Admin tools (`get_secret`, `exec_command`, `rotate_keys`) need it.
- Ops assistant (A2A): `https://mcp.decoy.day/a2a`
- Internal API: `https://decoy.day/api/internal/`

`Authorization: Bearer <api_key>`

Keys are scoped to `ops:read ops:write`. Rotate them with the `rotate_keys` tool.

## OAuth

Apps that prefer OAuth 2.0 can register at `https://decoy.day/oauth/register` (RFC 7591) and use the `client_credentials` grant at `https://decoy.day/oauth/token`. Metadata: `https://decoy.day/.well-known/oauth-authorization-server` and `https://decoy.day/.well-known/oauth-protected-resource`.