# Signing in to Wavo Intelligence as an agent

Wavo Intelligence has one door that signs an agent in: its workspace's MCP server, at https://terminal.cloud.wavo.me/api/mcp. It takes an OAuth 2.1 access token from WorkOS AuthKit, issued to the person the agent works for, and acts as that person. There are no API keys, and an agent cannot sign up on its own: the person signs in to Wavo Intelligence in a browser and lets the client in.

The workspace's MCP server is open to Wavo's team today: any account can sign in, and every tool refuses one outside it. Without a token, an agent reads the site (https://terminal.cloud.wavo.me/llms.txt), its public API (https://terminal.cloud.wavo.me/openapi.json) and its public MCP server (https://terminal.cloud.wavo.me/mcp), none of which asks for a key.

## 1. Discover

- A JSON-RPC POST to https://terminal.cloud.wavo.me/api/mcp without a token is answered `401` with a `WWW-Authenticate: Bearer` challenge whose `resource_metadata` is https://terminal.cloud.wavo.me/.well-known/oauth-protected-resource.
- That protected-resource metadata (RFC 9728) names the authorization server, AuthKit, whose own metadata is at `<authorization server>/.well-known/oauth-authorization-server` (RFC 8414).

## 2. Register the client

- Register with dynamic client registration (RFC 7591) at the endpoint AuthKit's metadata names, or at https://terminal.cloud.wavo.me/api/oauth/register, which forwards to it.
- AuthKit also accepts a client ID metadata document (`client_id_metadata_document_supported`).

## 3. Get a token

1. Send the person to the authorization endpoint in a browser, with the authorization code grant and PKCE (`S256`).
2. They sign in with their Wavo Intelligence account and approve the client.
3. Exchange the code at the token endpoint. Ask for `offline_access` to get a refresh token.

## 4. Call

- POST JSON-RPC 2.0 messages to https://terminal.cloud.wavo.me/api/mcp with `Authorization: Bearer <access token>` and `Accept: application/json, text/event-stream`.
- `tools/list` answers the tools the server lists the person; each call does what that person may do in the app, or is refused.

## When it fails

- `401`: the token is missing, expired or not AuthKit's. Refresh it, or send the person through step 3 again.
- A refusal of one call comes back in the tool's result, in words that say why.
- An `/api/` route that needs a session, asked without one, answers `401` in RFC 9457 JSON (`application/problem+json`) with a `code` and a `resolution`.

More: https://terminal.cloud.wavo.me/developers