# auth.md: Mockly English

How AI agents get access to Mockly English on behalf of a student.

## What needs no credentials

Everything public: every page (add `.md` for markdown), https://app.mocklyenglish.com/llms.txt, and these MCP tools at https://app.mocklyenglish.com/mcp: `check_cv_english`, `rewrite_star_story`, `build_tell_me_about_yourself`, `check_linkedin_profile`, `suggest_questions_to_ask_interviewer`, `write_interview_thank_you_email`, `build_why_hire_you_answer`, `build_strengths_weakness_answer`, `check_work_email_english`, `get_mockly_english_facts`, `get_coach_availability`, `get_booking_link`, `find_mockly_english_resources`. Just call them.

## What needs the student's sign-in

`book_session`, `get_my_sessions` and `alert_me_when_coach_is_free` act as a signed-in student (scope `bookings`). Mockly is its own OAuth 2.1 authorization server.

1. **Discover.** Calling a sign-in tool without a token returns HTTP 401 with `WWW-Authenticate: Bearer resource_metadata="https://app.mocklyenglish.com/.well-known/oauth-protected-resource/mcp"`. That document (RFC 9728) names the authorization server, https://app.mocklyenglish.com, whose metadata (RFC 8414) is at https://app.mocklyenglish.com/.well-known/oauth-authorization-server.
2. **Register.** Either POST your client metadata (`redirect_uris`, `client_name`) to https://app.mocklyenglish.com/oauth/register (RFC 7591 dynamic client registration; public clients, no secret), or use an https URL that serves a client ID metadata document as your `client_id`. Registration is anonymous: it identifies your app, not a person, and on its own grants nothing.
3. **Get the student's consent.** Send the student to https://app.mocklyenglish.com/oauth/authorize with `response_type=code`, PKCE (`S256`), `scope=bookings` and `resource=https://app.mocklyenglish.com/mcp`. They sign in to Mockly (or create a free account) and click Allow. This is the claim step: the access now belongs to that student.
4. **Get tokens.** Exchange the code at https://app.mocklyenglish.com/oauth/token (`grant_type=authorization_code` with your `code_verifier`). Access tokens last 1 hour; use `grant_type=refresh_token` to renew.
5. **Call the API.** Send `Authorization: Bearer <access_token>` to https://app.mocklyenglish.com/mcp.

## Limits

- Agents can't see payment details, change passwords or pay. Students buy session credits themselves on https://app.mocklyenglish.com/#pricing.
- Always confirm the coach and time with the student before `book_session`.
- Students cancel or reschedule in their Mockly dashboard and can disconnect the app at any time; ask them to sign in again if a refresh fails.

Setup guides for ChatGPT, Claude and other MCP apps: https://app.mocklyenglish.com/ai. Questions: contact@mocklyenglish.com.