> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dazie.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How the dazie CLI, SDK, API and MCP server sign in as a user: OAuth 2.1 with PKCE and dynamic client registration.

## Reading the docs

No registration is needed. The pages, their Markdown twins and the docs MCP server at `https://docs.dazie.io/mcp` are public.

## Acting for a user

Everything that touches a user's journal (the [API](https://docs.dazie.io/api-reference/introduction.md) and the MCP server at `https://api.dazie.io/mcp`) needs that user's OAuth 2.1 access token. The user approves each client on a consent screen at app.dazie.io and can deny it there.

To get a token:

1. Read the protected resource metadata at `https://api.dazie.io/.well-known/oauth-protected-resource`. Its `authorization_servers` entry is the issuer.
2. Read the issuer's authorization server metadata (RFC 8414) for the authorization, token and registration endpoints.
3. Register a public client with dynamic client registration (RFC 7591): `token_endpoint_auth_method: "none"`, grant types `authorization_code` and `refresh_token`, and your redirect URI. Native apps can use a loopback URI such as `http://127.0.0.1:<port>/callback`.
4. Send the user to the authorization endpoint with a PKCE `S256` code challenge and a `state`.
5. Exchange the code at the token endpoint with the code verifier. Use the refresh token to renew access tokens.

Send the token as `Authorization: Bearer <token>`. Requests without a valid token get `401` and a `WWW-Authenticate` header pointing at the metadata in step 1.

## Accounts

Agents can't create dazie accounts. A person signs up at [app.dazie.io](https://app.dazie.io/) with an email address and password, confirms it by email and finishes onboarding. Until then, writes return `onboarding_required`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.