# Auth.md — Locanoo

How AI agents and third-party clients authenticate with Locanoo, the rental
management platform for landlords in Québec.

- Site: https://locanoo.ca
- Documentation: https://locanoo.ca/documentation
- API description: https://locanoo.ca/openapi.json
- API catalog: https://locanoo.ca/.well-known/api-catalog
- Status: https://locanoo.ca/statut
- Contact: https://locanoo.ca/contact

## Summary

| Item | Value |
| --- | --- |
| Protocol | OAuth 2.1 / OpenID Connect (authorization code + PKCE) |
| Issuer | `https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1` |
| Authorization endpoint | `https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1/oauth/authorize` |
| Token endpoint | `https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1/oauth/token` |
| Dynamic client registration | `https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1/oauth/clients/register` (RFC 7591) |
| JWKS | `https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1/.well-known/jwks.json` |
| Discovery | `https://locanoo.ca/.well-known/openid-configuration`, `https://locanoo.ca/.well-known/oauth-authorization-server` |
| Protected resource metadata | `https://locanoo.ca/.well-known/oauth-protected-resource` |
| Identity types | Human user (delegated, on-behalf-of) |
| Credential types | OAuth access token (Bearer, JWT), refresh token |
| Scopes | `openid`, `profile`, `email`, `offline_access` |
| Bearer method | `Authorization: Bearer <access_token>` header |

## Registering an agent

1. Fetch authorization-server metadata:
   `GET https://locanoo.ca/.well-known/oauth-authorization-server`
2. Register the client dynamically at the `registration_endpoint`
   (RFC 7591), sending your client name and `redirect_uris`. No pre-shared
   client secret is required; public clients must use PKCE (`S256`).
3. Start the authorization code flow at `authorization_endpoint` with
   `response_type=code`, your `client_id`, `redirect_uri`, a PKCE challenge
   and `scope=openid profile email offline_access`.
4. The end user signs in to their Locanoo account (email/password or Google)
   and approves the consent screen. The agent never handles user passwords.
5. Exchange the code at `token_endpoint` for an access token and, when
   `offline_access` was granted, a refresh token.
6. Call Locanoo endpoints with `Authorization: Bearer <access_token>`.

## Authorization model

Access tokens act on behalf of the signed-in Locanoo user. All data access is
additionally enforced server-side by per-account row-level security: an agent
can only read or write the buildings, leases, tenants, payments and documents
that its user is authorized to see. OAuth scopes cover identity claims only and
never widen those account permissions.

## Revocation

- Users revoke agent access from their Locanoo account settings.
- Refresh tokens can be revoked by the client at the issuer's logout endpoint
  (`https://bionzpwywcqznnrtkqyq.supabase.co/auth/v1/logout`).
- Suspected abuse: write to https://locanoo.ca/contact and access is revoked
  manually.

## Public endpoints (no authentication)

- `POST /newsletter-subscribe` — newsletter signup, see `/openapi.json`.
- Marketing, pricing, legal and blog pages are public and crawlable
  (see `/robots.txt` and `/sitemap.xml`).

## Content usage

`robots.txt` declares Content Signals: `search=yes, ai-input=yes, ai-train=no`.
Agents may read and cite Locanoo content; training generative models on it is
not permitted.