# SanadiqCloud authentication

SanadiqCloud is a multi-tenant ERP for inventory, billing, and operations.
This document describes how clients authenticate. It follows the spirit of the
[auth.md](https://workos.com/auth-md) discovery format without claiming
agent-registration flows that SanadiqCloud does not implement.

## Agent registration (auth.md protocol)

SanadiqCloud does **not** support agent-initiated user registration via the
auth.md agent-verified or user-claimed flows. Do not attempt automated account
creation on behalf of users.

## Human users

Users sign in at [https://sanadiqcloud.com/login](https://sanadiqcloud.com/login)
using email and password or Google Sign-In.

## API access

The production API is hosted at
[https://api.sanadiqcloud.com](https://api.sanadiqcloud.com).

- Most `/api/*` routes require a **Bearer JWT** access token issued after login.
- Send `Authorization: Bearer <access_token>` on protected routes.
- Multi-tenant requests also require `X-Tenant-ID` (or a tenant-scoped path).
- Unauthenticated requests to protected routes receive HTTP **401**.

Token session endpoints (public at the gateway) include:

- `POST /api/auth/v1/login`
- `POST /api/auth/v1/login/google`
- `POST /api/auth/v1/refresh` (refresh JWT as Bearer)

Tokens are returned in response headers (`X-Access-Token`, `X-Refresh-Token`),
not in JSON bodies.

## Public resources (no JWT)

- API catalog (RFC 9727): `https://api.sanadiqcloud.com/.well-known/api-catalog`
- Product documentation: `https://api.sanadiqcloud.com/docs`
- Gateway health: `https://api.sanadiqcloud.com/health`
- Marketing site catalog: `https://sanadiqcloud.com/.well-known/api-catalog`

## OAuth / OIDC

SanadiqCloud is **not** an OAuth 2.0 authorization server. Google Sign-In is
used only for human authentication in the web and mobile clients. There is no
public `/.well-known/openid-configuration` for third-party API clients.

## MCP, WebMCP, and agent skills

SanadiqCloud does not publish a production MCP server, WebMCP endpoint, or
external agent-skills registry on this domain. Internal engineering skills under
`.cursor/` are for development only and are not deployed to production.