# WoW-God auth.md

## Agent access

WoW-God's documented public guide API is available without a bearer token. See [the API documentation](/docs/api) and [OpenAPI description](/openapi.json). The public guide-assistant endpoint is rate-limited and may return a budget or availability response.

For account-scoped integrations, WoW-God provides OAuth 2.0 authorization code flow with mandatory PKCE (S256). The server metadata is at [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server), and the protected-resource metadata is at [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource).

## Human accounts

Players can sign in with a Battle.net account through the browser at [/login](/login). WoW-God uses that authorization only to create a first-party browser session for account features such as character settings, social features, and collection syncing.

Battle.net access tokens are not accepted as WoW-God API bearer tokens and must not be sent to public WoW-God API endpoints.

## Registration and provisioning

OAuth client registration is deliberately account-owned, not anonymous. Sign in with Battle.net, then create a public PKCE client with POST /api/oauth/clients using the first-party session. Supply a short client name and one to five exact HTTPS redirect URIs. http://localhost is accepted only for local development.

Use the returned client.id with /oauth/authorize, response_type=code, scope=wowgod.api, an exact registered redirect_uri, a state value, and an S256 code_challenge. The player explicitly approves the request. Exchange the resulting code once at /oauth/token using application/x-www-form-urlencoded with grant_type=authorization_code, client_id, redirect_uri, and code_verifier.

Access tokens are opaque bearer tokens, expire after one hour, and currently grant access only to GET /api/agent/me. Do not send Battle.net tokens to WoW-God API endpoints, and do not treat WoW-God bearer tokens as Battle.net credentials.

## Content and discovery

WoW-God's [robots policy](/robots.txt) permits search and agent input while declining AI training reuse. Discovery metadata is available through the [API catalog](/.well-known/api-catalog) and [agent index](/.well-known/agent-index.json).