# mooola authentication for agents

Public website pages, bank guides and local browser converters need no account or access token. This website is not an OAuth issuer and does not provide an API for uploading bank statements.

## Existing MCP service

- Transport: Streamable HTTP at https://api.mooola.co.za/mcp
- Resource identifier: `https://api.mooola.co.za/mcp`
- Protected resource metadata: https://api.mooola.co.za/.well-known/oauth-protected-resource/mcp
- Authorization server issuer: `https://api.mooola.co.za/api/auth`
- Authorization server metadata: https://api.mooola.co.za/.well-known/oauth-authorization-server/api/auth

Discover current endpoints, supported registration methods and scopes from those canonical metadata documents. The path component `/api/auth` is part of the issuer; do not replace it with the website origin. Metadata was checked on 5 November 2026.

Use a standard MCP OAuth client with the advertised authorization-code flow and PKCE S256. User sign-in and consent must happen in the authorization server's flow. Request only the scopes needed for the task. Current resource scopes are `personal:read`, `personal:write` and `share:write`; write operations also require the applicable read permission and live feature consent.

Discovery does not grant access. Financial tools enforce account eligibility, current client consent, scope and ownership. Remote financial access must be enabled by the user; Share operations have additional feature gates. Some related product features are still marked coming soon on the public website.

Do not send MCP tokens to app-session `/api/*` endpoints, ask users to paste access tokens or banking credentials into chat, or use the website's converter diagnostics endpoint as a financial API. There is no separate Auth.md agent-identity registration protocol or payment protocol advertised here.

See the [account data guide](https://mooola.co.za/blog/mooola-accounts-and-your-data) and [privacy policy](https://mooola.co.za/privacy) for storage and consent details.