# Auth.md

Authentication at Transcribe.so: how humans, API clients, and AI agents
authenticate with https://transcribe.so.

## Humans (web app)

Sign in or create an account at https://transcribe.so/auth/login. Sign-in is "Continue
with Google": one click creates the account if it does not exist yet, and new
accounts start with signup credit. There is no separate registration form and
no password to manage.

## API clients (Bearer keys)

The HTTP API at https://transcribe.so/api/v1 uses Bearer authentication with API keys.

1. Sign in to the web app and create a key in the dashboard (Settings > API keys).
   Pick Full access or Read only (GET endpoints only; POST/DELETE answer 403
   scope_forbidden) and, optionally, a monthly spend cap (402 spend_cap_exceeded
   once transcription jobs, clip renders, or realtime sessions would pass it;
   starting a realtime session reserves its full 60-minute cap up front).
2. Keys look like `tsk_live_...`. Send them on every request:

```
Authorization: Bearer tsk_live_your_key_here
```

The full API surface, request shapes, and error codes are in the OpenAPI spec
at https://transcribe.so/api/v1/openapi.yaml. A machine-readable catalog of the API is at
https://transcribe.so/.well-known/api-catalog.

## AI agents (OAuth 2.0 for MCP)

The MCP server at https://transcribe.so/mcp accepts either a `tsk_live_*` Bearer key or an
OAuth 2.0 access token.

The OAuth flow is authorization code with PKCE (S256):

- Authorization endpoint: https://transcribe.so/oauth/authorize
- Token endpoint: https://transcribe.so/oauth/token
- Discovery metadata: https://transcribe.so/.well-known/oauth-authorization-server
- Grant types: `authorization_code`, `refresh_token`
- Scopes: `email`, `profile`
- Client authentication: `client_secret_basic`, `client_secret_post`, or
  `none` (public clients, PKCE only, no client secret)

An unauthenticated request to https://transcribe.so/mcp returns 401 with a
`WWW-Authenticate` header pointing at
https://transcribe.so/.well-known/oauth-protected-resource/mcp (RFC 9728, the path-suffixed
document for the `/mcp` resource; the root document at
https://transcribe.so/.well-known/oauth-protected-resource describes the origin), so MCP
clients that implement the current auth spec discover the flow automatically.
Claude and ChatGPT connectors both work this way today.

Dynamic client registration (RFC 7591) is available at
https://supabase.transcribe.so/auth/v1/oauth/clients/register.

## MCP and skills discovery

- MCP server card: https://transcribe.so/.well-known/mcp/server-card.json
- Agent skills index: https://transcribe.so/.well-known/agent-skills/index.json

## Notes

- API usage is billed to the account wallet; rate limits and pricing per
  endpoint are documented at https://transcribe.so/developers/docs.
- Support: support@transcribe.so