---
title: "Authentication — MoneyTrees"
description: "How agents and apps get access to MoneyTrees: no credential, or OAuth 2.1 with PKCE."
canonical: https://moneytrees.ai/docs/authentication
last-updated: 2026-10-27
---

# Authentication

MoneyTrees has three access levels.

## No credential

Public market data (`/api/v1` except `/me`), the sandbox, NLWeb `/ask` and the market and docs MCP servers need nothing. `POST https://moneytrees.ai/agent/identity` with `{"type":"anonymous"}` confirms it.

## OAuth 2.1 for account access

The product MCP server and `/api/v1/me` take an OAuth 2.1 access token for one user.

1. Fetch [/.well-known/oauth-protected-resource](https://moneytrees.ai/.well-known/oauth-protected-resource). It names the resource and its authorization server.
2. Fetch [/.well-known/oauth-authorization-server](https://moneytrees.ai/.well-known/oauth-authorization-server) for the endpoints.
3. Register a client dynamically at the `registration_endpoint`.
4. Send the user to the `authorization_endpoint` with PKCE (S256). They sign in to MoneyTrees and approve the client.
5. Exchange the code at the `token_endpoint`. Send `Authorization: Bearer <token>`.

The scope is `email`. Users see and revoke connected apps in Settings.

## Errors

A request without a valid token gets HTTP 401 and:

```
WWW-Authenticate: Bearer resource_metadata="https://moneytrees.ai/.well-known/oauth-protected-resource/api/mcp", scope="email"
```

The full agent walkthrough is [auth.md](https://moneytrees.ai/auth.md).