# Advant auth.md

Agent registration for Advant. The public site and the jobs MCP need no auth. The candidates API uses bearer tokens.

## What needs auth

- Public, no token: `GET /jobs`, `GET /jobs/{slug}`, `POST /mcp`, all `/.well-known/*`.
- Bearer token: candidates API at `https://app.advant.co/api/v1/*` (profile, tracker, filing).

## Register

Create an account (verified email flow):

- `POST https://app.advant.co/api/v1/auth/register` with `name`, `email`, `password`.
- Or register in a browser at `https://app.advant.co/register`.

## Get a token

- `POST https://app.advant.co/api/v1/auth/login` with `email`, `password`. The response holds the bearer token.
- Send it as `Authorization: Bearer <token>` on candidates API calls.

## Revoke

- `POST https://app.advant.co/api/v1/auth/logout-all` revokes every token on the account.

## Discovery documents

- Protected resource: `https://advant.co/.well-known/oauth-protected-resource`
- Authorization server: `https://advant.co/.well-known/oauth-authorization-server`
- OpenID configuration: `https://advant.co/.well-known/openid-configuration`