# auth.md - DCXV Authentication

> This file explains how an AI agent or automated client can register, sign in and
> discover account state on https://ua.dcxv.com. It contains no credentials.

## What requires no login

The public catalog (https://ua.dcxv.com/catalog.json, https://ua.dcxv.com/openapi.json), all marketing
and documentation pages, the blog, and the FAQ. An agent can read prices, specs and
availability for every product without authenticating.

## Registration

- URL: https://ua.dcxv.com/my/register
- Required: email address, password. No phone number, no payment method to browse.
- Email verification is required before the account can place a paid order.

## Login

- URL: https://ua.dcxv.com/my/login
- Method: email + password, standard HTML form POST. On success the client
  receives a token, which it then sends in the Authorization header of every
  request as a Bearer-scheme credential - there is no server-side session or
  cookie involved.
- Social sign-in also exists (GitHub, Google, LinkedIn, Facebook) - DCXV is an
  OAuth *client* of those providers for that purpose, the same way any "Sign in
  with Google" button is. DCXV itself is not an OAuth2 authorization server:
  there is no https://ua.dcxv.com/.well-known/oauth-authorization-server and no
  https://ua.dcxv.com/.well-known/oauth-protected-resource. Both are deliberately absent
  - there is no token endpoint, no client registration, and no scoped-token
  model to describe. Do not assume either document exists.

## Personal API tokens

- URL: https://ua.dcxv.com/my/api (requires login)
- A signed-in user can mint a personal token there. The token goes in the
  Authorization header of a GraphQL request, the same mechanism the CLI's
  device login (below) also produces a token for.
- This is the closest thing to an API key issuance flow on this site - it is
  not OAuth2: there is no client registration, no token refresh, and no scopes.
  A token is full-account access, equivalent to the user's own login, and does
  not expire on its own. It is revoked by deleting it at https://ua.dcxv.com/my/api.
  (A per-token IP allowlist field exists in the token-management UI; treat it
  as informational only until this document says otherwise.)

## CLI / device login

The `dcxv` command-line client (https://ua.dcxv.com/cli) authenticates without a password
prompt in the terminal: the CLI prints a short code and opens
https://ua.dcxv.com/my/cli/{code} in a browser, where the already-signed-in user approves
it. This is a human-in-the-loop flow, not something an agent can complete
unattended - it exists to let a human hand a terminal session the same kind of
personal token described above.

## MCP (local, via the CLI)

`dcxv mcp` runs a Model Context Protocol server over stdio, on the user's own
machine, reusing whatever token `dcxv login` already saved. There is no hosted
MCP endpoint at any DCXV hostname and nothing to discover on the network - an
agent finds it the way it finds any local tool, by being configured to run
`dcxv mcp` in its MCP client config. Because it runs as an already-authenticated
human, it has no unauthenticated public surface to secure by construction, which
is also why none of the OAuth discovery documents above exist for it.

Tool tiers, gated by CLI flag: public catalog lookups need no login at all;
account/server reads need only a saved login; reversible actions (power/rename/
lock) need an explicit `--allow-write` flag; anything that charges the account
(ordering, renewing) needs `--allow-write`, `--allow-billing`, and an
environment variable set on the same machine. Deleting a server, paying an
invoice, exporting account data, and switching into a sub-account are never
exposed through MCP at any flag combination - see https://ua.dcxv.com/cli for the full
command reference.

A machine-readable description of this server (the npm package it ships as,
its version, and that it is stdio-only with no hosted counterpart) is published
at https://ua.dcxv.com/.well-known/mcp/server-card.json.

## Agent Skills

An [Agent Skills](https://agentskills.io) discovery index is published at
https://ua.dcxv.com/.well-known/agent-skills/index.json, listing SKILL.md files for
choosing a DCXV product, provisioning infrastructure, and managing an
existing account through the MCP tools described above. Each entry's
`digest` is the SHA-256 of the exact file served at its `url` - verify it
before trusting cached skill content.

## What requires authentication

Everything under https://ua.dcxv.com/my/* beyond registration and login: server/VPS
management, billing, invoices, IPv4 blacklist reports tied to an account,
support tickets.

## Authorization model

- **No login required**: browse the catalog, read prices and specs, read the blog
  and FAQ.
- **Login required**: view or manage servers, view invoices and balance, open
  support tickets, use the IPv4 blacklist scanner against your own netblocks.
- **Human confirmation always required**: placing an order, changing billing or
  payment details, deleting or reinstalling a server. There is no unattended
  purchase or payment API - an agent cannot complete a checkout on a user's
  behalf without that user directly confirming it in the account area.

## Contact

Questions about integrating with DCXV programmatically: sales@dcxv.com. See also
https://ua.dcxv.com/developers for the CLI, the public catalog API and this document, in
one place.