# Xquik auth.md

Xquik supports interactive OAuth and claimed agent registration. Both grant `mcp:tools` only after user approval.

## Discover

- Protected resource: https://xquik.com/.well-known/oauth-protected-resource/mcp
- Authorization server: https://xquik.com/.well-known/oauth-authorization-server
- Agent profile: its `agent_auth` block publishes canonical fields and working URI aliases.

## Interactive OAuth

Prefer this path when the client can open a browser and receive a redirect.

1. Publish a Client ID Metadata Document at a stable HTTPS URL. Repeat its URL as `client_id`.
2. Public clients use `none`. Private clients use `private_key_jwt`, RS256, and a same-origin `jwks_uri`.
3. Without metadata, register at `POST https://xquik.com/api/oauth/register`.
4. Authorize with S256 PKCE, a 43 to 128 character verifier, and `resource=https://xquik.com/mcp`. Then validate `iss` and exchange the code.

## Claimed agent registration

Use `service_auth` when the agent knows the user's verified email. Xquik issues no anonymous credentials.

1. POST `{"type":"service_auth","login_hint":"user@example.com"}` to `https://xquik.com/agent/identity`.
2. Show the returned `claim.verification_uri` and `claim.user_code` to the user.
3. The user opens that URI, signs in, and enters the code. The signed-in email must match `login_hint`.
4. Poll `https://xquik.com/api/oauth/token` at the returned interval. Send form fields `grant_type=urn:workos:agent-auth:grant-type:claim` and `claim_token`.
5. Handle `authorization_pending`, `slow_down`, `access_denied`, and `expired_token` exactly as returned.
6. On success, store the access token and `identity_assertion` as secrets.

If only the 6-digit code expires, POST `claim_token` and the same `email` to `https://xquik.com/agent/identity/claim`. Register again when the outer claim expires.

Exchange a current `identity_assertion` at the token endpoint with `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` and `assertion`. Xquik accepts service-signed assertions for active registrations. This returns a new access token without a refresh token. When the assertion expires or returns `invalid_grant`, discard it and repeat registration.

## Call MCP

Send tokens through `Authorization: Bearer <token>`. Xquik serves MCP 2026-07-28 through stateless Streamable HTTP.

## Revoke

Revoke OAuth tokens at `POST https://xquik.com/api/oauth/revoke`. To disconnect a claimed registration, send its `identity_assertion`, `client_id=urn:xquik:agent-auth`, and `token_type_hint=urn:ietf:params:oauth:token-type:id-jag`. This revokes the registration and every derived access token.
Delete unused dashboard API keys. Never send a password, session cookie, user code, or token to another party.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.