# Kangram Authentication for Agents

> How AI agents and API clients authenticate to Kangram (https://kangram.app). The MCP endpoint is https://kangram.app/mcp (Streamable HTTP).

## OAuth 2.1 (recommended for agent clients)

- Protected resource metadata: https://kangram.app/.well-known/oauth-protected-resource
- Authorization server metadata: https://kangram.app/.well-known/oauth-authorization-server
- Dynamic client registration (public, PKCE-only clients): `POST https://kangram.app/api/oauth/register`
- Flow: authorization code + PKCE (S256 required). Tokens are RFC 8707 resource-bound to `https://kangram.app/mcp`.
- Default registered scopes: `profile`, `boards:read`, `tasks:read`, `tasks:write`

## API keys (personal)

- Create a key at https://kangram.app/account/api-keys (per-user, full access to your own boards and data)
- Send as `Authorization: Bearer <key>` to https://kangram.app/mcp and the REST API at https://kangram.app/api/v1

## Related

- REST API docs (OpenAPI): https://kangram.app/api/v1/docs
- MCP server card: https://kangram.app/.well-known/mcp/server-card.json
- Pricing: https://kangram.app/pricing.md