# auth.md

Customer.io exposes agent-facing documentation and MCP access for users who already have a Customer.io account.

## Agent audience

Agents can use this documentation site to discover Customer.io API references, Markdown documentation, and the Customer.io MCP server.

## Authentication methods

- Customer.io MCP uses OAuth 2.0 authorization code flow with dynamic client registration. See [Customer.io MCP setup](https://docs.customer.io/ai/mcp/get-started/).
- Customer.io App API requests use bearer App API keys created in Customer.io account settings.
- Customer.io Track API and Pipelines API requests use workspace credentials documented in the API reference.

## Discovery documents

The authoritative OAuth infrastructure lives on the MCP host (mcp.customer.io), which issues the tokens and registers the clients. Use its metadata:

- OAuth authorization server metadata: https://mcp.customer.io/.well-known/oauth-authorization-server
- OAuth protected resource metadata: https://mcp.customer.io/.well-known/oauth-protected-resource

This documentation site publishes its own catalogs:

- API catalog: https://docs.customer.io/.well-known/api-catalog
- MCP server card: https://docs.customer.io/.well-known/mcp/server-card.json

This site also serves a copy of the OAuth metadata at `https://docs.customer.io/.well-known/oauth-authorization-server` and `.../oauth-protected-resource` so agents that only probe the origin they landed on can still find it. Those copies are for discovery. Read the endpoints, scopes, and registration details from mcp.customer.io.

## Registration

For MCP clients, register directly with the Customer.io MCP authorization server at https://mcp.customer.io/oauth2/register.

For API access, create credentials in Customer.io:

- App API keys: `https://fly.customer.io/settings/api_credentials?keyType=app`
- Workspace credentials for Track and Pipelines APIs: follow the setup instructions in the relevant API reference.