# Authentication - DCXV

> This file explains how an AI agent or automated client can register, sign in and
> discover account state on https://dcxv.com. It contains no credentials.

## What requires no login

The public catalog (https://dcxv.com/catalog.json, https://dcxv.com/openapi.json), all marketing
and documentation pages, the blog, and the FAQ. An agent can read prices, specs and
availability for every product without authenticating.

## Registration

- URL: https://dcxv.com/my/register
- Required: email address, password. No phone number, no payment method to browse.
- Email verification is required before the account can place a paid order.

## Login

- URL: https://dcxv.com/my/login
- Method: email + password, standard HTML form POST, session cookie on success.
- No OAuth, no OIDC, no social login. There is no
  https://dcxv.com/.well-known/oauth-authorization-server and no
  https://dcxv.com/.well-known/oauth-protected-resource - both are deliberately absent
  because no OAuth2 service exists to describe. Do not assume one.

## Personal API tokens

- URL: https://dcxv.com/my/api (requires login)
- A signed-in user can mint a personal token there, optionally restricted to an
  IP allowlist. The token goes in the Authorization header of a GraphQL request,
  the same mechanism the CLI's device login (below) also produces a token for.
- This is the closest thing to an API key issuance flow on this site - it is not
  OAuth2, there is no client registration, no token refresh, no expiry, and no
  scopes beyond the account itself and the optional IP restriction.

## CLI / device login

The `dcxv` command-line client (https://dcxv.com/cli) authenticates without a password
prompt in the terminal: the CLI prints a short code and opens
https://dcxv.com/my/cli/{code} in a browser, where the already-signed-in user approves
it. This is a human-in-the-loop flow, not something an agent can complete
unattended - it exists to let a human hand a terminal session the same kind of
personal token described above.

## MCP (local, via the CLI)

`dcxv mcp` runs a Model Context Protocol server over stdio, on the user's own
machine, reusing whatever token `dcxv login` already saved. There is no hosted
MCP endpoint at any DCXV hostname and nothing to discover on the network - an
agent finds it the way it finds any local tool, by being configured to run
`dcxv mcp` in its MCP client config. Because it runs as an already-authenticated
human, it has no unauthenticated public surface to secure by construction, which
is also why none of the OAuth discovery documents above exist for it.

Tool tiers, gated by CLI flag: public catalog lookups need no login at all;
account/server reads need only a saved login; reversible actions (power/rename/
lock) need an explicit `--allow-write` flag; anything that charges the account
(ordering, renewing) needs `--allow-write`, `--allow-billing`, and an
environment variable set on the same machine. Deleting a server, paying an
invoice, exporting account data, and switching into a sub-account are never
exposed through MCP at any flag combination - see https://dcxv.com/cli for the full
command reference.

## What requires authentication

Everything under https://dcxv.com/my/* beyond registration and login: server/VPS
management, billing, invoices, IPv4 blacklist reports tied to an account,
support tickets.

## Authorization model

- **No login required**: browse the catalog, read prices and specs, read the blog
  and FAQ.
- **Login required**: view or manage servers, view invoices and balance, open
  support tickets, use the IPv4 blacklist scanner against your own netblocks.
- **Human confirmation always required**: placing an order, changing billing or
  payment details, deleting or reinstalling a server. There is no unattended
  purchase or payment API - an agent cannot complete a checkout on a user's
  behalf without that user directly confirming it in the account area.

## Contact

Questions about integrating with DCXV programmatically: sales@dcxv.com. See also
https://dcxv.com/developers for the CLI, the public catalog API and this document, in
one place.