# auth.md — GEORD

GEORD connection, at no cost. Resource: https://mcp.benchmarca.com.br/mcp. Scope: geord:ask.

1. POST /agent/identity with type service_auth and login_hint (your verified account email). Anonymous and provider assertions are unsupported.
2. Show claim.verification_uri and claim.user_code to the user. No access is issued before confirmation.
3. The user signs in on the GEORD confirmation screen, connects GEORD through its existing OAuth consent, and enters the code on our confirmation page. Never collect user passwords or ask them to send you the code.
4. Poll /token with grant_type urn:workos:agent-auth:grant-type:claim and claim_token; honor interval.
5. Use returned access_token only at https://mcp.benchmarca.com.br/mcp. Exchange identity_assertion at /token using urn:ietf:params:oauth:grant-type:jwt-bearer and resource https://mcp.benchmarca.com.br/mcp.
6. POST token to /revoke to revoke only that access token. The assertion remains usable until its expiry. The user can end the entire delegation on the completion page.
7. Each code expires after 10 minutes; while registration is active, POST /agent/identity/claim with claim_token and the same email to get a new attempt. Never ask the user to send the code to the assistant.
8. A confirmed delegation lasts at most one hour. JWT-bearer exchange renews access within that window. On reauthorization_required, show verification_uri to the user. Ambiguous upstream refresh requires renewed consent; do not blindly replay it. Claim token response may be retried after 5 seconds for 60 seconds: the same encrypted response is returned, without minting duplicate credentials.