Auth server discovery
sigmaidentity.com hosts documentation. auth.sigmaidentity.com hosts authentication and the discovery surfaces below. Discovery helps a client find a protocol; it does not grant authorization or remove human approval requirements.
| Surface | URL | Scope |
|---|---|---|
| Developer portal | /developers | Human and agent orientation |
| API catalog | /.well-known/api-catalog | Links to machine-readable surfaces |
| OAuth metadata | /.well-known/oauth-authorization-server | RFC 8414 endpoints and grants |
| OIDC discovery | /.well-known/openid-configuration | Issuer, JWKS, userinfo, and scopes |
| Agent discovery | /.well-known/agent-configuration | Agent modes, capabilities, approval requirements |
| OpenAPI | /openapi.json | Better Auth routes under /api/auth |
| Interactive API reference | /api/auth/reference | Generated Better Auth reference |
| Agent orientation | /llms.txt | Text guide on the auth host |
| Certificate catalog | /api/certificates/types | Type IDs and claim fields |
| Trust manifest | /manifest.json | Certifier metadata and enabled discovery |
OAuth protocol naming
Sigma uses Better Auth's OAuth 2.1 provider. OAuth 2.1 remains an IETF draft; RFC 8414's OAuth 2.0 title and /oauth2/ paths are not stale protocol selections. The deployed discovery document advertises S256 PKCE. Sigma also requires registered Bitcoin client signatures for code and refresh exchange, which generic metadata does not describe.
Start with integration. A relying-party application uses the client/server callback package exports; sigmaProvider() is for running an issuer, not connecting to one.
MCP and WebMCP
The server MCP endpoint is POST /.well-known/mcp using Streamable HTTP. A GET returns 405 by design; a crawler's GET-only check is not a complete MCP compatibility test. Use protocol initialization and the advertised tool schemas. Do not assume an arbitrary REST request is an MCP tool call.
The homepage also has browser-side WebMCP tool registration where the browser exposes navigator.modelContext. WebMCP and server MCP are different interfaces. Tool discovery is not permission to sign, decrypt, export keys, or bypass a user approval screen.
Gated surfaces
Certificate readiness, handle allocation/discovery, seed creation, and commercial features have independent controls. Read wallet credentials, handles, and backup formats. Do not interpret a public type catalog as proof that issuance or billing is active.