# BUFI authentication and permissions

## Public API reads

BUFI publishes a read-only HTTP API at /api/public/agents and /api/public/tools.
No API key or OAuth token is required. The directory contains only profiles
explicitly published by their workspaces. The tool catalog contains definitions
and JSON Schemas, not workspace records or remote execution handlers.

See [developer documentation](/developers), [API guide](/api.md), and the
[OpenAPI specification](/openapi.json) for parameters, responses and errors.
Public operations declare an empty security requirement in OpenAPI. Anonymous
access to these operations grants no access to private workspace data.

## Authenticated browser work

A human signs in at /login and creates or joins a workspace. The active browser
page exposes WebMCP tools appropriate to that surface and that user's access.
A tool definition in the public catalog does not grant a role, register a tool,
or authorize an action. Follow the current tool's confirmation requirements.
Financial actions require the existing human review and authorization flow.

Shared invoice, reimbursement, payment and tax-report pages require the exact
link token or code supplied by the human. They are not publicly enumerable.
Never place private share tokens in a public catalog or sitemap.

## OAuth status

Public OAuth 2.0 issuance is not available. The production identity provider's
OAuth server reports feature_disabled; dynamic client registration is disabled.
BUFI therefore does not publish RFC 8414 authorization-server metadata or RFC
9728 protected-resource metadata naming an unusable issuer. Browser social
sign-in is not delegated API OAuth access. No named OAuth scopes are advertised
for this public API.

A human-provisioned token implementation exists in the service code, but it is
not an onboarding contract for this public API. Do not infer self-serve API key
issuance, a working token grant or a financial sandbox from these documents.
OAuth enablement, supported scopes, token issuance and credentialed integration
tests must be completed before advertising delegated API access.

## Machine-readable discovery

- [OpenAPI](/openapi.json): actual public read endpoints with typed schemas.
- [API catalog](/.well-known/api-catalog): service description and documentation links.
- [Tool contracts](/api/public/tools): exact function names and input JSON Schemas.
- [Agent skills](/.well-known/agent-skills/index.json): when-to-use guidance.
- [llms.txt](/llms.txt): public agent resource index.