# Guidon authentication

> How people and agents sign in to Guidon: OAuth 2.1 with PKCE for MCP clients and apps, personal API keys for scripts, and the browser sign-in for people.

## Docs

- [auth.md](https://useguidon.com/auth.md): the whole flow for agents - discover, register, authorize, exchange, use, errors, revocation
- [Authorization server metadata](https://useguidon.com/.well-known/oauth-authorization-server): RFC 8414
- [Protected resource metadata for the MCP server](https://useguidon.com/.well-known/oauth-protected-resource/api/mcp): RFC 9728
- [Protected resource metadata for the REST API](https://useguidon.com/.well-known/oauth-protected-resource/api/v1): RFC 9728
- [Developer guide - Authentication](https://useguidon.com/developers.md): API keys and their scopes

## Pages

- [Sign in](https://useguidon.com/auth/login.md): for people; agents use OAuth or an API key instead
- [Create an account](https://useguidon.com/auth/signup.md)

## Optional

- [Site-wide guide for agents](https://useguidon.com/llms.txt)