Docs / OAuth & Security
OAuth & Security
OAuth consent, account route scopes, bearer forwarding, cache policy, and the boundary between account access and execution.
Updated 2026-07-22
Consent and credentials
Account-bound access requires a Supabase OAuth 2.1 bearer token and active Stakao consent for the token client_id.
Public discovery, catalog, search, MCP, and x402 allocation analysis do not require OAuth. OAuth is used only when an agent requests account-bound data or submits a human-reviewed activation request.
Account request
bash
curl -i https://api.stakao.com/agent/account/me \
-H 'Authorization: Bearer <supabase-oauth-access-token>'Route scopes
The backend enforces both token scopes and the scopes stored in the active Stakao consent.
- GET https://api.stakao.com/agent/account/me — openid.
- GET https://api.stakao.com/agent/account/wallets — openid profile.
- GET https://api.stakao.com/agent/account/strategies — openid profile.
- POST https://api.stakao.com/agent/account/activation-requests — openid profile email.
- GET/POST https://api.stakao.com/agent/mcp/account — openid profile transport access; tool-specific calls enforce their account scope.
Proxy and cache policy
The Worker forwards Authorization only on exact account routes and never caches account responses.
- Public x402 and public MCP requests have Authorization removed before origin forwarding.
- Account responses use Cache-Control: private, no-store.
- 401 responses preserve or synthesize WWW-Authenticate: Bearer.
- Cookies, bearer tokens, OAuth bodies, and account payloads are excluded from Worker logs.
No agent execution
OAuth account access does not grant on-chain execution authority.
Account reads are tenant-scoped to the authenticated user. request_activation creates a PENDING record for human review. It does not sign, create a proxy, create a delegate transaction, write user_strategies, or call the chain.
Agent entrypoints
Agent manifest
Worker-generated discovery manifest and safety metadata.
Agent OpenAPI
Canonical REST contract generated by the Worker.
Agent llms.txt
Worker-generated operational instructions.
Agent errors
Machine-readable error codes and remediation.
Public MCP
Unauthenticated read-only MCP transport.
Auth reference
Raw authentication and payment reference.