# auth.md - Ply

You are an agent looking for how to use Ply. The docs, the component registry, and the hosted MCP connector are public. Ply does not issue agent identities or access tokens. Follow this file through step 3 and use those public surfaces.

`POST /agent/identity`, `POST /oauth2/token`, and `POST /oauth2/revoke` are not implemented. A `404` from those paths is final.

Hosts:

- Docs and component registry: `https://ply-ui.com/`
- Agent index: `https://ply-ui.com/llms.txt`
- Hosted MCP (catalog only): `https://mcp.ply-ui.com/mcp`
- This skill file: `https://ply-ui.com/auth.md`
- Protected Resource Metadata: `https://ply-ui.com/.well-known/oauth-protected-resource`
- Hosted MCP metadata: `https://mcp.ply-ui.com/.well-known/oauth-protected-resource`

There is no authorization server. Fetching `/.well-known/oauth-authorization-server` is not part of this flow.

## Step 1 — Discover

Fetch the Protected Resource Metadata. That JSON is authoritative. If this prose and the JSON ever disagree, follow the JSON.

```http
GET /.well-known/oauth-protected-resource HTTP/1.1
Host: ply-ui.com
```

```json
{
  "resource": "https://ply-ui.com/",
  "resource_name": "Ply",
  "resource_documentation": "https://ply-ui.com/auth.md",
  "resource_logo_uri": "https://ply-ui.com/assets/pwa/apple-touch-icon.png",
  "authorization_servers": [],
  "scopes_supported": [],
  "bearer_methods_supported": []
}
```

`authorization_servers` is an empty list, so registration is not offered. The list is present and empty on purpose: an omitted list would mean this host is its own authorization server.

The hosted MCP connector publishes the same shape with `"resource": "https://mcp.ply-ui.com/mcp"`. A self-hosted `ply-ui-mcp --http` process that was started with an operator token lists `"bearer_methods_supported": ["header"]`. The public site and the hosted connector leave that list empty.

When that self-hosted process rejects a request, the response is:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://<that-host>/.well-known/oauth-protected-resource"
```

The public site and the hosted connector do not send that challenge. They accept the request without a bearer token.

## Step 2 — Pick a method

Ply supports none of the registration types.

- `identity_assertion` is not enabled.
- `service_auth` is not enabled.
- `anonymous` is not enabled.

There is no registration body, no claim page, and no assertion to exchange.

## Step 3 — Use the public catalog

Install and read components without a token.

One-time setup in the consumer project:

```bash
npx ply-ui-cli init --yes
npx ply-ui-cli add dialog card --yes
```

Local MCP, which can install into the project:

```bash
npx -y ply-ui-mcp
```

Hosted MCP, which can search the catalog and cannot write the consumer's files:

```text
https://mcp.ply-ui.com/mcp
```

Machine-readable catalog: `https://ply-ui.com/llms.txt` and `https://ply-ui.com/registry/index.json`. Setup for each agent host: `https://ply-ui.com/getting-started/#ai-agents-mcp`.

Pro components need the purchaser's license key in `PLY_LICENSE_KEY` on the CLI or MCP process. That key is a license. Buy it at `https://ply-ui.com/pricing/`.

## Errors

| What you tried | What happens | What to do |
| --- | --- | --- |
| `POST /agent/identity` | `404`. The path does not exist. | Stop. Use step 3. |
| `POST /oauth2/token` | `404`. There is no token endpoint. | Stop. There is no access token. |
| `POST /oauth2/revoke` | `404`. There is no token to revoke. | Stop. |
| Hosted MCP without a bearer token | The connector is public. | Call the catalog tools. |
| Self-hosted MCP `401` | The operator set a shared secret. | Send `Authorization: Bearer` with the token they configured. Registration will not produce that token. |

## Scopes

No scopes. The metadata lists `scopes_supported` as an empty array.

## Revocation

Ply does not issue access tokens, so there is nothing to revoke at `/oauth2/revoke`. A Pro license is handled by the seller.

## Contact

Questions: [GitHub discussions](https://github.com/ply-ui-ng/ply/discussions). License and pricing: [https://ply-ui.com/pricing/](https://ply-ui.com/pricing/).