# TalentPrism auth.md

TalentPrism exposes a read-only, team-scoped MCP Streamable HTTP endpoint for approved managed-service customers.
Claude connects through OAuth 2.0. Existing CLI and server integrations may continue using TalentPrism API keys.

## Discover

- MCP OAuth authorization server metadata: `https://talentprism.ai/.well-known/oauth-authorization-server/oauth/`
- Legacy API-key discovery metadata: `https://talentprism.ai/.well-known/oauth-authorization-server`
- MCP protected resource metadata: `https://talentprism.ai/.well-known/oauth-protected-resource/mcp/`
- MCP server card: `https://talentprism.ai/.well-known/mcp/server-card.json`
- Developer documentation: `https://talentprism.ai/developers/`

## Eligibility

Public signup is disabled. OAuth never creates a TalentPrism user, team, membership, or API key. You must already
have an approved TalentPrism account and belong to a provisioned recruiting team. If you do not, use the Book a Demo
path on `https://talentprism.ai/`.

## Connect Claude

1. Add `https://talentprism.ai/mcp/` as a custom connector in Claude.
2. Sign in to your existing TalentPrism account when the browser authorization screen opens.
3. Choose the team Claude may read and approve the `mcp:tools:read` scope.
4. Return to Claude. No API key is shown or copied.

Claude registers as a public client, sends an S256 PKCE challenge, and receives short-lived access tokens plus rotating
refresh tokens. The token audience is exactly `https://talentprism.ai/mcp/`.

## API key compatibility

The `tp` CLI and existing integrations remain compatible. An already-provisioned customer may create a team-scoped
TalentPrism API key at `https://talentprism.ai/users/api-keys/create/` and send:

```http
Authorization: Api-Key <talentprism-api-key>
```

OAuth does not create, migrate, rotate, or invalidate these keys.

## Errors

HTTP API errors use JSON with a stable code, message, and resolution. MCP errors use JSON-RPC 2.0 error objects.
An HTTP 401 includes a Bearer challenge and means the credential is missing, invalid, expired, or revoked. HTTP 403
with `insufficient_scope` means the token lacks `mcp:tools:read`. Authorization errors do not reveal whether an email,
user, team, candidate, or token exists.

## Disconnect

Disconnect TalentPrism in Claude's connector settings. TalentPrism's revocation endpoint invalidates the complete
team-scoped OAuth grant, and expired or revoked tokens fail on the next MCP call. API keys are managed separately on
the TalentPrism API key screen.

## Security boundaries

The public MCP surface exposes only existing read-only `external_agent` capabilities. It excludes write and sending
tools, payment, raw-transcript, audit-history, and internal Copilot tools. Team authorization, PII masking, and capability
audit logging remain in force for every call.