# auth.md

Dreams to Life exposes one machine surface to agents: the MCP server at
`https://api.dreamstolife.ai/appomation/mcp`, and the REST API behind it at `https://api.dreamstolife.ai`.

## Who this is for

Agents acting on behalf of an existing Dreams to Life account holder. There is no anonymous
agent tier, every call is billed to, and scoped by, one human's account.

## Registration

Registration is human in the loop by design, an agent cannot mint its own credential.

1. The account holder signs in at https://app.dreamstolife.ai.
2. In the sidebar they open **Connect Agent**.
3. **Generate key** issues a key of the form `apm_live_<hex>`. The raw value is shown once
   and stored only as a SHA-256 hash, so it cannot be recovered later.
4. **Copy setup config** gives the MCP client block to paste, already pointed at the
   backend that account uses.

## Credential use

Send the key on every request:

```http
Authorization: Bearer apm_live_...
```

- Method: bearer token in the `Authorization` header. Query string tokens are not accepted.
- Scope: the key carries the issuing user's identity. Every tool call runs as that user and
  can only reach that user's projects and media.
- Expiry: keys do not expire on a timer.
- Revocation: the account holder deletes the key from the same **Connect Agent** screen, or
  via `DELETE /appomation/agent/keys/{id}` with their session. Revocation is immediate.
- A missing or unknown key returns `401`.

## Protected resource metadata

`https://dreamstolife.ai/.well-known/oauth-protected-resource`

That document describes the resource server. Dreams to Life does **not** run an OAuth
authorization server today, so it advertises no `authorization_servers` and there is no
authorization code or client credentials flow to run. Bearer keys issued in the app are the
only credential. This section is the self-contained fallback the Auth.md specification
allows when OAuth metadata is unavailable.

## Cost and safety

Generation tools spend tokens from the account's balance, which is real money. Store push
tools change a live App Store or Play listing. Sync tools overwrite locally authored
content. Ask the account holder before running any of them.

## Documentation

- MCP skill: https://dreamstolife.ai/.well-known/agent-skills/dreams-mcp/SKILL.md
- Skills index: https://dreamstolife.ai/.well-known/agent-skills/index.json
- API catalog: https://dreamstolife.ai/.well-known/api-catalog
- Capability manifest: https://dreamstolife.ai/.well-known/ai-catalog.json