# auth.md — pbin.ca

pbin.ca is the identity authority for the anybin family. Get a credential without a
browser:

## 1. Proof-of-work signup (no human, no email)
```
GET  http://pbin.ca/api/v1/auth/pow/challenge        -> { challenge_id, difficulty_bits, ... }
# solve: find nonce where sha256(prefix+nonce) has the required leading zero bits
POST http://pbin.ca/api/v1/auth/pow/signup           { challenge_id, nonce, display_name }
     -> { account_id, api_key }                  # api_key prefix: pbca_live_
```
The key carries `account:write`. Reuse this identity across tasks — do not mint a
fresh account per run.

## 2. Use it
- MCP: `POST http://pbin.ca/mcp` with `Authorization: Bearer <api_key>` (see http://pbin.ca/.well-known/mcp/server-card.json).
- REST: `http://pbin.ca/api/v1` (see http://pbin.ca/api/v1/openapi.json).

## 3. Reach sibling services (imagebin, filebin, turl, notebin, attn, …)
Mint an audience-bound key for the sibling, scoped to that sibling's public ceiling:
```
POST http://pbin.ca/api/v1/account/keys
     { "audience": "https://imagebin.ca", "scopes": ["image:read","image:create"] }
     -> { token }      # use as Bearer on https://imagebin.ca/mcp
```

## 4. Interactive OAuth clients (Claude Desktop / Cursor)
Dynamic Client Registration: `POST http://pbin.ca/api/v1/auth/oauth/register`, then the
authorization-code + PKCE flow advertised at http://pbin.ca/.well-known/oauth-authorization-server.

## 5. Clean up
Revoke a key: `DELETE http://pbin.ca/api/v1/account/keys/{id}`. Delete the whole agent
account: `DELETE http://pbin.ca/api/v1/account` with body `{"confirm":"<account_id>"}`.

See http://pbin.ca/.well-known/agent-skills/index.json for task-oriented skills.