# Intakra auth.md

How AI assistants and other software agents get access to Intakra (https://intakra.com). Intakra watches public records for the companies a sales team sells to and records dated, cited leads in that team's workspace.

## No credentials needed

- The public MCP tools `score_buying_signal_evidence` and `prepare_why_now_review` on https://intakra.com/mcp. They use only the evidence in the call and keep nothing.
- Public pages (also as markdown with `Accept: text/markdown`), https://intakra.com/llms.txt and the discovery documents under https://intakra.com/.well-known/.

## OAuth 2.1 for workspace tools

A workspace's data is only reachable through a grant a person approves. Agents cannot approve their own access.

- Protected resources: https://intakra.com/mcp and https://intakra.com/api/mcp. Metadata (RFC 9728): https://intakra.com/.well-known/oauth-protected-resource/mcp and https://intakra.com/.well-known/oauth-protected-resource/api/mcp.
- Authorization server: https://intakra.com. Metadata: https://intakra.com/.well-known/oauth-authorization-server and https://intakra.com/.well-known/openid-configuration.
- Register a client with dynamic client registration (RFC 7591): `POST https://intakra.com/oauth/register`. Public clients only (`token_endpoint_auth_method: none`).
- Authorization code grant with PKCE (S256) at https://intakra.com/oauth/authorize and https://intakra.com/oauth/token, with the `resource` parameter (RFC 8707) set to the MCP endpoint you call. Refresh tokens are issued.
- A person signs in to Intakra in the browser, picks the workspace and approves the scopes. The grant stays bound to that workspace, and membership and role are checked on every call.
- Send the access token as `Authorization: Bearer <token>`. No other bearer method is accepted.
- Revoke with https://intakra.com/oauth/revoke. The person can also remove the connection at https://intakra.com/oauth/connections.

Scopes:

- `openid`: Identify your connected Intakra account.
- `email`: Share your verified account email.
- `accounts:read`: Read the selected workspace's tracked companies, recorded findings and opportunities, including the person named for each lead (name, role, LinkedIn page and work email).
- `accounts:write`: Import companies you confirm into the selected workspace, within its current plan limit.
- `offering:write`: Replace the selected workspace's offering description after you confirm the change.

## Workspace API keys

For the REST API (https://intakra.com/openapi.json) and API-key MCP clients on https://intakra.com/api/mcp.

- A workspace member creates the key in Intakra under Settings, API and MCP. It starts with `ik_live_` and is shown once.
- Send it as `Authorization: Bearer ik_live_...`.
- Anyone with the key can read the workspace's leads and act on them. The member can revoke it in Settings at any time.

## Agent sign-in with AgentID

An agent with an AgentID identity can sign in to the Intakra website at https://intakra.com/login/agentid (OpenID Connect with PKCE). A new identity gets its own Intakra account and goes through the normal setup in the browser. The agent's identity stays separate from any person's account.

## Not supported

- No agent self-registration endpoint, and no anonymous, verified-email or identity-assertion (ID-JAG) credentials.
- No client secrets, client credentials grant or token in a query string.

Questions: hello@intakra.com. Support: https://intakra.com/support.