# Authorization

Step 0 of every integration: obtain a Bearer credential. A person automating their own
work creates an API key in the Developer Portal; agents, MCP hosts and
applications acting for a user walk the Authorization Code + PKCE browser flow; marketplace
applications will exchange client credentials for an installation token (planned, second
delivery). The OAuth endpoints live outside `/api/v3` on the authorization server host.

 - [GET /.well-known/oauth-authorization-server](https://developer.alteg.io/en/b2b-v3/openapi/authorization/getoauthauthorizationservermetadata.md): Machine-readable OAuth 2.0 authorization server metadata (RFC 8414): endpoint URLs, supported grant types, PKCE methods, and scopes. Agents and MCP hosts use this document to discover the authorizatio
 - [POST /oauth/token](https://developer.alteg.io/en/b2b-v3/openapi/authorization/createoauthtoken.md): OAuth 2.0 token endpoint (RFC 6749). Supports three grants: - `authorization_code` — exchange a code obtained from the browser `GET /oauth/authorize` flow (PKCE `code_verifier` required). Returns an a
 - [POST /oauth/revoke](https://developer.alteg.io/en/b2b-v3/openapi/authorization/revokeoauthtoken.md): OAuth 2.0 token revocation (RFC 7009). Revokes an access token or a refresh token; revoking a refresh token revokes its whole token family. The endpoint returns `200` even when the token is already in
 - [POST /oauth/register](https://developer.alteg.io/en/b2b-v3/openapi/authorization/registeroauthclient.md): Minimal Dynamic Client Registration (RFC 7591) for MCP hosts and other clients that are not pre-registered. Registration only issues a `client_id` — access to any data still requires the user login/co
 - [GET /oauth/accessible-resources](https://developer.alteg.io/en/b2b-v3/openapi/authorization/listaccessibleresources.md): Returns the resources **this token** is actually granted — not everything the user or application could reach. Each entry carries the scopes granted on that resource, so a client knows which `location