# Genvernium authentication --- title: Genvernium authentication canonical: https://genvernium.com/auth.md --- Genvernium's customer workspace is accessed through the public sign-in flow: 1. Open [sign in](https://genvernium.com/sign-in). 2. Complete the account verification and sign-in steps shown by the service. 3. Continue to the authenticated workspace only after the session is established. The public discovery API is read-only and does not accept API keys or anonymous mutation requests. Workspace APIs require a verified customer session. Do not submit passwords, private keys, API tokens, payment-card data, or other secrets to public discovery resources. Authentication endpoints and session cookies are implementation details of the customer application. The public discovery surface uses the `public.read` permission only. Workspace permissions are scoped separately as `workspace.read`, `workspace.write.approval`, and `workspace.admin`; external side effects always require a customer approval. The public read-only MCP endpoint is documented at [MCP server card](https://genvernium.com/.well-known/mcp/server-card.json) and [MCP endpoint](https://genvernium.com/mcp). It exposes discovery resources only and no customer workspace mutation tools. The authenticated product MCP endpoint is documented at [workspace MCP server card](https://genvernium.com/.well-known/mcp/product-server-card.json) and [workspace MCP endpoint](https://genvernium.com/mcp/workspace). It exposes read-only workspace tools only and requires a verified customer session with the `workspace.read` scope. ## Agent authentication discovery - Protected resource metadata: https://genvernium.com/.well-known/oauth-protected-resource - Authorization server metadata: https://genvernium.com/.well-known/oauth-authorization-server - agent_auth: the versioned boundary at https://genvernium.com/api/v1 returns a JSON 401 response for unauthenticated requests and advertises WWW-Authenticate: Bearer resource_metadata="https://genvernium.com/.well-known/oauth-protected-resource". - identity_endpoint: no public identity endpoint is published. Customer identity is established by the sign-in flow above. - oauth-protected-resource: the protected-resource document identifies the read-only authenticated workspace MCP resource and its required `workspace.read` scope. - oauth-authorization-server: Genvernium operates a public OAuth 2.0 authorization-code issuer with PKCE S256, dynamic public-client registration, exact redirect-URI matching, one-hour bearer tokens, and revocation. It does not issue OIDC identity tokens. The public discovery API is intentionally read-only. OAuth delegation is also read-only: `workspace.read` is bound to the approving verified customer session and cannot grant write, billing, administration, or publishing access. ## Discover Start at [protected-resource metadata](https://genvernium.com/.well-known/oauth-protected-resource), [agent resources](https://genvernium.com/.well-known/agent-skills/index.json), or the public [OpenAPI document](https://genvernium.com/openapi.json). ## Pick a method For public documentation, use the read-only MCP endpoint or the public HTTP resources. For a customer-approved workspace MCP connection, use the OAuth authorization-code flow with PKCE S256 and request only `workspace.read`. ## API reliability and versioning Authenticated workspace write requests require an `Idempotency-Key` so safe retries do not create duplicate review actions. Long-running analysis work is queued with durable status inside the authenticated workspace. API errors are JSON and include a machine-readable code, message, status, and resolution when available. The versioned boundary is `/api/v1`; breaking changes use a new major path, and deprecations are announced with `Deprecation` and `Sunset` headers before removal. ## Register Public OAuth clients can register at [https://genvernium.com/oauth/register](https://genvernium.com/oauth/register). Registration accepts only public authorization-code clients with exact HTTPS redirects (or loopback redirects for local development); no client secret is issued. Customer accounts are created through [sign up](https://genvernium.com/sign-up) with the required legal acceptance and verification flow. ## Claim There is no public claim endpoint. A customer must establish identity through the first-party sign-in flow and receive a verified customer session. ## Exchange After the customer approves the request at [https://genvernium.com/oauth/authorize](https://genvernium.com/oauth/authorize), exchange the short-lived authorization code at [https://genvernium.com/oauth/token](https://genvernium.com/oauth/token) with the original PKCE verifier. Access tokens expire after one hour. The [workspace MCP endpoint](https://genvernium.com/mcp/workspace) accepts the bearer token only for read-only workspace tools. ## Use the access_token Send the token as `Authorization: Bearer ` to the authenticated workspace MCP endpoint. Do not send passwords, session cookies, or private credentials to public discovery resources. Tokens are scoped to the approved client and workspace session; request only the minimum scope. ## Errors Unauthenticated requests to https://genvernium.com/api/v1 return JSON 401 with a WWW-Authenticate resource-metadata pointer. Invalid public discovery parameters return JSON 400 with a stable error code. ## Revocation OAuth access tokens can be revoked at [https://genvernium.com/oauth/revoke](https://genvernium.com/oauth/revoke). Customer sessions can also be revoked through the authenticated account controls. Public discovery resources do not retain customer session credentials.