# Comunicate.eu auth.md

How AI agents and programs authenticate with Comunicate.eu, a Romanian platform for publishing press releases, advertorials and SEO articles.

## Audience

Agents and integrations acting for an organisation that has a Comunicate.eu account. A person creates the account and stays in control of what an agent may do.

## No credentials needed

These are read-only and need no key, no account and no registration:

- Public API: `https://app.comunicate.eu/api/v1/public/*` (catalogue, niches, market statistics, budget plans). Spec: https://comunicate.eu/openapi.json
- MCP server: `https://app.comunicate.eu/mcp` (streamable HTTP). The catalogue tools work without authentication.
- UCP catalogue: profile at https://comunicate.eu/.well-known/ucp

## API key

1. A person signs in and creates a key in Integrations: https://app.comunicate.eu/ro/integrari
2. The person chooses the scopes: `CATALOG_READ`, `ARTICLES_READ`, `ARTICLES_WRITE`, `MEDIA_WRITE`, `PUBLICATIONS_READ`, `PUBLICATIONS_WRITE`, `CAMPAIGNS_READ`, `CAMPAIGNS_WRITE`, `BALANCE_READ`, `REPORTS_READ`.
3. The agent sends it on every request: `Authorization: Bearer bk_live_…`

The same key works for the REST API (`https://app.comunicate.eu/api/v1/partner`) and for the MCP server.

## OAuth 2.1

For assistants and integrations that connect on a person's behalf, without copying keys:

- Authorization server metadata (RFC 8414): https://app.comunicate.eu/.well-known/oauth-authorization-server
- Protected resource metadata (RFC 9728): https://app.comunicate.eu/.well-known/oauth-protected-resource (REST API) and https://app.comunicate.eu/.well-known/oauth-protected-resource/mcp (MCP server)
- Dynamic client registration (RFC 7591): `POST https://app.comunicate.eu/api/v1/oauth/register`
- Flow: authorization code with PKCE (`S256`), refresh tokens supported. The person signs in and approves the scopes.
- Redirect URIs are limited to supported assistant clients and local development addresses. To add a client, write to contact@comunicate.eu.
- The access token is an API key with the scopes the person approved, accepted everywhere an API key is.

An unauthenticated call to a tool or route that needs an account gets `401` with `WWW-Authenticate: Bearer … resource_metadata="…"`, so a client can start the flow on its own.

## What an agent cannot do alone

- Create an account: a person does it.
- Spend money: ordering tools (`order_publication`, `order_writing`) work only after the organisation switches on ordering by AI assistants. Otherwise an agent prepares drafts and plans and a person places the order.

## Contact

contact@comunicate.eu