# Bountii auth.md

Bountii (https://getbountii.com) is a pay-per-meeting B2B sales marketplace. This file tells an AI agent how authentication works here, what it can do without credentials, and how to act on behalf of a person who has an account.

## Audience

Agents acting for a **company** (posting bounties, reviewing meetings) or for a **bounty hunter** (claiming accounts, chatting with companies). Both kinds of user are people with a Bountii account. There are no agent-only accounts and no machine registration.

## What needs no authentication

Everything a visitor can read: the marketing pages (also as markdown with `Accept: text/markdown`), https://getbountii.com/llms.txt, the read-only JSON API described at https://getbountii.com/api/public/openapi.json, and the MCP server at https://getbountii.com/mcp. Start there.

## Discovery documents

- Protected resource metadata (RFC 9728): https://getbountii.com/.well-known/oauth-protected-resource
- Authorization server metadata (RFC 8414): https://getbountii.com/.well-known/oauth-authorization-server
- OpenID Connect discovery: https://getbountii.com/.well-known/openid-configuration

The issuer is Bountii's identity provider, Supabase Auth: `https://bwgrzizumnqbxvqfodka.supabase.co/auth/v1`. Its JWKS is linked from the documents above. Session tokens are RS256/ES256 JWTs with that issuer.

## Registration

1. A person creates the account at https://getbountii.com/signup (hunters now; companies from 19 October 2026). Signup is a human step: it asks for a LinkedIn profile, agreement to the terms, and email confirmation.
2. Agents must not create accounts, and must not collect a person's password.

## Getting a token

The person signs in and hands the agent an access token from their session. Two supported ways:

- **From the person's browser session.** After login at https://getbountii.com/login, the Supabase session cookie holds `access_token` and `refresh_token`. The person can copy the access token to the agent.
- **Password grant, performed by the person.** Supabase Auth accepts the site's public (anon) key plus the person's credentials:

```
POST https://bwgrzizumnqbxvqfodka.supabase.co/auth/v1/token?grant_type=password
apikey: sb_publishable_CBn2EfzJYciXBzEUT6d7eQ_gqWfiODV
Content-Type: application/json

{"email": "...", "password": "..."}
```

The response carries `access_token` (JWT, ~1 hour) and `refresh_token`. Refresh with `grant_type=refresh_token` at the same endpoint. The anon key is public by design; it grants nothing by itself.

The OAuth 2.1 authorization-code flow listed in the metadata (`/oauth/authorize`, `/oauth/token`) belongs to the issuer and is not enabled for Bountii yet; those endpoints answer `feature_disabled` until it is. When it is turned on, this file will say so and describe client registration.

## Using the token

Send it as a bearer token:

```
GET https://getbountii.com/api/public/me
Authorization: Bearer <access_token>
```

That endpoint returns the account the token belongs to. A missing or invalid token gets `401` with `WWW-Authenticate: Bearer resource_metadata="https://getbountii.com/.well-known/oauth-protected-resource"`.

The rest of the account surface (the dashboard) is a browser application authenticated by the same session cookie; it has no separate write API today. Do not attempt to drive it without the person's explicit instruction.

## Revocation

`POST https://bwgrzizumnqbxvqfodka.supabase.co/auth/v1/logout` with the bearer token ends the session. The person can also sign out from https://getbountii.com/dashboard/settings/account.

## Contact

welcome@getbountii.com