# auth.md

Agent authentication for **UCS Online Psych**.

## Audience

AI agents and patient-facing integrations that need to call the booking API or guide users through sign-in.

## Human / patient registration

1. Open [https://www.ucsmed.com/login](https://www.ucsmed.com/login)
2. Create an account with email/password or Continue with Google
3. Complete OAuth callback at `https://www.ucsmed.com/auth/callback`
4. Use the Supabase access token as `Authorization: Bearer <token>` against the Nest API

## Machine discovery

- Protected resource metadata: [https://www.ucsmed.com/.well-known/oauth-protected-resource](https://www.ucsmed.com/.well-known/oauth-protected-resource)
- Authorization server metadata: [https://www.ucsmed.com/.well-known/oauth-authorization-server](https://www.ucsmed.com/.well-known/oauth-authorization-server)
- OpenID configuration: [https://www.ucsmed.com/.well-known/openid-configuration](https://www.ucsmed.com/.well-known/openid-configuration)
- Token issuer (Supabase Auth): `https://mbnyghndbpuoffzeqrij.supabase.co/auth/v1`
- API resource: `https://api.preproinstitute.com/booking/`
- Organization header required: `Organization-Id: ucsmed`

## Supported methods

| Method | How |
|--------|-----|
| verified_email | Email/password or Google at `/login` |
| anonymous browse | Public catalog endpoints need no token |
| bearer access_token | After login, call `https://api.preproinstitute.com/booking` with Bearer token |

## Scopes

`openid`, `email`, `profile`, `offline_access`

## Notes

- Do not store clinical notes in Stripe metadata.
- Staff admin uses a separate panel; patient sites do not issue staff memberships.