# nwsppr auth.md

How AI agents get access to nwsppr. Three ways in, from no sign-in to a company's own paper.

## 1. No sign-in: today's top stories

- HTTP: `GET https://www.nwsppr.ai/api/agents/top-stories?industry=<slug>&limit=1-6`
- MCP: `https://mcp.nwsppr.ai/signup` (tools: todays_top_stories, list_plans, start_signup)
- Signup for a person who asked: `POST https://www.nwsppr.ai/api/agents/signup` with `person_agreed: true`. No email is sent and nothing is charged.

## 2. Pay per call: x402

- `GET https://www.nwsppr.ai/api/v1/stories?industry=<slug>&limit=1-25&date=YYYY-MM-DD`
- No account. Call it, get HTTP 402 with a `PAYMENT-REQUIRED` header (x402 v2, base64 JSON), pay $0.04 in USDC on eip155:8453 to 0xc93a70d1f6e020719f1987e3d167681a76e998c7 by signing the payment, and call again with `PAYMENT-SIGNATURE`.
- The reply carries a `PAYMENT-RESPONSE` header with the settlement receipt. Days with no edition answer 404 and aren't charged.

## 3. A company's own paper: OAuth 2.1 on the MCP server

- MCP server: `https://mcp.nwsppr.ai/mcp` (tools: get_paper, list_stories, get_story, list_desks, get_profile; read-only).
- Authorization server: `https://mcp.nwsppr.ai` (metadata at `https://mcp.nwsppr.ai/.well-known/oauth-authorization-server`).
- Register your client dynamically (RFC 7591) at `https://mcp.nwsppr.ai/register`, then authorization code with PKCE (S256). Public clients, no secret.
- A person at the company signs in and approves one company's paper. Scope: `read`. Send the token as `Authorization: Bearer <token>`.
- Access ends when the company's plan lapses, the person leaves the team, or anyone disconnects the agent.

## Discovery

- API catalog: https://www.nwsppr.ai/.well-known/api-catalog
- OpenAPI: https://www.nwsppr.ai/openapi.json
- MCP server card: https://www.nwsppr.ai/.well-known/mcp/server-card.json
- Agent skills: https://www.nwsppr.ai/.well-known/agent-skills/index.json
- Protected resource metadata: https://www.nwsppr.ai/.well-known/oauth-protected-resource