# Authentication at bookvisit.com

This page explains which BookVisit resources need credentials and how an agent gets them.

## Public website and content API: no credentials

The website, its Markdown views and the content API at https://bookvisit.com/api/v1 are public and read-only. They need no API key, token or account, and no request needs an `Authorization` header. The API description is at https://bookvisit.com/openapi.json.

## Help centre MCP server: OAuth 2.0

The BookVisit help centre runs an MCP server at https://help.bookvisit.com/mcp. It is hosted by Zendesk and needs an OAuth 2.0 access token.

1. Discover: read the protected resource metadata (RFC 9728) at https://help.bookvisit.com/.well-known/oauth-protected-resource/mcp. It names the authorization server, https://help.bookvisit.com/mcp/oauth.
2. Read the authorization server metadata (RFC 8414) at https://help.bookvisit.com/.well-known/oauth-authorization-server/mcp/oauth.
3. Register: the authorization server supports client ID metadata documents (`client_id_metadata_document_supported`).
4. Authorise with the authorization code flow and PKCE (`S256`). The user signs in and grants access.
5. Exchange the code for an access token at the token endpoint given in the metadata.
6. Call the MCP server with `Authorization: Bearer <access token>`.

The scopes published by the help centre are `read` and `write`. Request only what the task needs.

## Developer portal

The BookVisit developer portal at https://developers.bookvisit.com requires sign-in. To ask about access, contact BookVisit through https://bookvisit.com/contact-and-support/.