# Neblla — agent registration (auth.md)

Neblla is a backend for apps and games built by AI agents, used through its MCP server. If your user has no Neblla developer account yet, you can open it for them here, without a form, and get a token for the MCP.

Supported registration: **service_auth** (verified email). Not supported: anonymous, identity_assertion (ID-JAG).

## Flow

1. **Register** with your user's email:

   ```
   POST https://developers.neblla.com/agent/identity
   Content-Type: application/json

   { "type": "service_auth", "login_hint": "dev@example.com" }
   ```

   The answer carries `registration_id`, `claim_token` (keep it) and `claim: { expires_in, verification_uri, interval }`. Neblla emails a six-digit code to that address. The code is never sent to you.

2. **Ask your user for the code** from the email (it works for 10 minutes), and complete the claim:

   ```
   POST https://developers.neblla.com/agent/identity/claim/complete
   Content-Type: application/json

   { "claim_token": "clm_…", "user_code": "123456" }
   ```

   The user can also type the code at `verification_uri` instead. Five wrong codes close the registration: start again.

3. **Get the token**:

   ```
   POST https://developers.neblla.com/oauth/token
   Content-Type: application/x-www-form-urlencoded

   grant_type=urn:workos:agent-auth:grant-type:claim&claim_token=clm_…
   ```

   Until the claim is complete the answer is `{ "error": "authorization_pending" }` (poll every `interval` seconds; faster gets `slow_down`; after the window, `expired_token`). Then: `{ access_token, token_type: "Bearer", expires_in, refresh_token, scope: "mcp" }`, issued once. Refresh it at the same endpoint with `grant_type=refresh_token&client_id=neblla-agent-auth`.

4. **Use it** as the Bearer token of the MCP server: `https://developers.neblla.com/mcp`. Start with `neblla_get_llms`.

Completing the code opens the developer account for that email, or signs into it if it already exists. Limits: 3 registrations per email and 5 per IP per hour.

## Discovery

- Authorization server metadata: `https://developers.neblla.com/.well-known/oauth-authorization-server` (its `agent_auth` block).
- Protected resource metadata: `https://developers.neblla.com/.well-known/oauth-protected-resource/mcp`.
- Guide for building apps: `https://developers.neblla.com/llms.txt`.