---
title: "ProxyAI OAuth and authentication"
description: Understand ProxyAI's public access, account-scoped MCP OAuth permissions, user-approved registration and separate purchase authorization.
canonical: https://www.proxyai.app/docs/authentication
last-updated: 2026-10-19
---

> For the complete documentation index, see [llms.txt](https://www.proxyai.app/llms.txt). Request public content pages with `Accept: text/markdown`.

# ProxyAI OAuth and authentication

ProxyAI separates public product information, account-scoped MCP access and purchase authorization. Choose credentials for the specific resource you intend to call.

## Public access

The `/mcp` server exposes the read-only public product catalogue. The REST catalogue at `/api/v1/products` is also public. Neither grants access to bots, tickets, customer messages or Agent Tasks.

## MCP OAuth discovery

The account MCP endpoint is `https://www.proxyai.app/api/mcp`. Discover its protected resource at `/.well-known/oauth-protected-resource/api/mcp` and the authorization server at `/.well-known/oauth-authorization-server`.

Connect through a supported MCP client's OAuth flow and sign in to ProxyAI in your browser. Review the account and permissions before approving access. Read the [MCP setup guide](https://www.proxyai.app/help/pro-tips/proxyai-mcp) for client-specific instructions.

## Read and write permissions

The `read` scope permits account reads. Actions require both `read` and `write`, approved through **Allow changes**. Permission covers current and future bots in the account, with no per-bot consent option. Existing add-on requirements, held-plan approvals and billing controls still apply.

Revoke a connection in your account's connector settings when it is no longer needed. Never give a client your password or send its MCP token to an unrelated endpoint.

## User-approved agent registration

When enabled, ProxyAI supports `service_auth` registration on behalf of a user. Registration creates a pending request; a human must approve it before account access is granted. Read the current `auth.md` document for the registration sequence and the deployed authorization metadata for supported endpoints. Do not treat registration as automatic consent.

## Purchase authorization

Purchases use a separate authorization resource and purchase permissions. MCP `read` and `write` scopes do not authorize checkout operations. Follow [API documentation](https://www.proxyai.app/docs/api), the deployed `/openapi.json`, and the relevant payment protocol's discovery document.