# Authenticating agents with smbuild

smbuild's MCP endpoint is `https://trysmbuild.com/api/mcp` (Streamable HTTP). Agents get access in one of two ways. Both are scoped to a single smbuild organization.

## OAuth 2.1 (recommended for AI apps)

- Protected resource metadata: `https://trysmbuild.com/.well-known/oauth-protected-resource/api/mcp`
- Authorization server metadata: `https://trysmbuild.com/.well-known/oauth-authorization-server/api/auth`
- Dynamic client registration is open. Request `resource=https://trysmbuild.com/api/mcp` to receive a JWT access token.
- The user signs in, picks the organization on the consent screen, and can revoke access at any time under Dashboard → Your agent → Connected apps.

## API key

- An organization owner or admin creates a key at `https://trysmbuild.com/dashboard/agent`.
- Send it as `Authorization: Bearer smb_live_…`. Keys are stored hashed and can be revoked from the same page.

## Public, no auth

- `/llms.txt`, `/llms-full.txt`, `/index.md`, `/.well-known/mcp/server-card.json`, `/.well-known/api-catalog`