# auth.md: Connecting an agent to Promptafire

Promptafire runs a read-only MCP server at
`https://marketing.promptafire.com/api/mcp` (Streamable HTTP).

## Without an account

Any MCP client can connect with no credentials and use every tool. Free
modules, the blog, and pricing are fully readable. Pro lessons return a
short description and instructions instead of their body.

## With a Pro account

Authentication is OAuth 2.1 with PKCE and dynamic client registration.

1. Fetch `/.well-known/oauth-protected-resource/api/mcp`. It names the authorization
   server. No OAuth scopes are requested; approving the consent screen is
   the permission.
2. Register with the authorization server and start the authorization code
   flow. The member signs in to Promptafire and sees a consent screen that
   says exactly what the grant allows: reading lessons they have access to,
   nothing else.
3. Call `/api/mcp` with the access token as a bearer header.

Entitlement is checked on every call. If the member's Pro access ends, the
agent keeps its connection but Pro lessons lock again until they renew.

## Revoking

Members see every connected agent under Settings and can revoke any of them.
Revocation stops the agent from getting new access tokens immediately. Any
token it already holds keeps working until it expires, which happens within
an hour.

## What the server will never do

There are no write scopes. No tool changes a member's account, progress,
prompts, or billing.

Client setup example:

    claude mcp add --transport http promptafire https://marketing.promptafire.com/api/mcp