# AiVikings auth.md

AiVikings provides domain registration and management tools for AI agents through an MCP server and REST API.

## Choose an authentication path

Use OAuth 2.1 with Dynamic Client Registration for MCP. The MCP endpoint is [https://mcp.aivikings.ai/mcp](https://mcp.aivikings.ai/mcp). MCP-compatible clients discover the protected resource metadata, register a client dynamically, request authorization, obtain a bearer access token, and call tools with that token. This is the path used by the ChatGPT connector and other MCP-compatible clients.

Use an API key for direct REST API calls to [https://api.aivikings.ai/v1](https://api.aivikings.ai/v1). Create an account at [https://app.aivikings.ai/register](https://app.aivikings.ai/register), verify the account, then create and manage API keys in the AiVikings dashboard. Send the key in the `Authorization: Bearer YOUR_AIVIKINGS_API_KEY` request header. Do not place API keys in public prompts, browser JavaScript, source control, or shared agent memory.

## REST API key registration flow

1. Register and verify an account at [app.aivikings.ai/register](https://app.aivikings.ai/register).
2. Sign in to the dashboard and create an API key for the agent or integration.
3. Call the REST API with the key in the `Authorization: Bearer YOUR_AIVIKINGS_API_KEY` header.
4. Revoke and replace the key in the dashboard if it is exposed.

## OAuth discovery

- Authorization server: [https://api.aivikings.ai](https://api.aivikings.ai)
- Protected resource metadata: [https://mcp.aivikings.ai/.well-known/oauth-protected-resource](https://mcp.aivikings.ai/.well-known/oauth-protected-resource)
- Authorization server metadata: [https://api.aivikings.ai/.well-known/oauth-authorization-server](https://api.aivikings.ai/.well-known/oauth-authorization-server)
- Dynamic client registration: [https://api.aivikings.ai/oauth/register](https://api.aivikings.ai/oauth/register)
- Authorization endpoint: [https://api.aivikings.ai/oauth/authorize](https://api.aivikings.ai/oauth/authorize)
- Token endpoint: [https://api.aivikings.ai/oauth/token](https://api.aivikings.ai/oauth/token)

Supported OAuth scopes include `domains:read`, `domains:write`, `domains:transfer`, `billing:read`, `contacts:read`, `contacts:write`, and `offline_access`.

## Credential use

OAuth access tokens are sent in the `Authorization: Bearer TOKEN` header when calling MCP tools. REST API keys are sent in the same header format when calling REST API endpoints. API keys and OAuth access tokens are different credentials and are not interchangeable.

## Related discovery

- Documentation: [https://docs.aivikings.ai](https://docs.aivikings.ai)
- MCP discovery: [https://aivikings.ai/.well-known/mcp.json](https://aivikings.ai/.well-known/mcp.json)
- Agent capability catalog: [https://aivikings.ai/.well-known/ai-catalog.json](https://aivikings.ai/.well-known/ai-catalog.json)
- API catalog: [https://aivikings.ai/.well-known/api-catalog](https://aivikings.ai/.well-known/api-catalog)