# Authentication — CA Afzal Lokhandwala

> **Machine-readable metadata**
> - Protected resource: `https://afzallokhandwala.com/.well-known/oauth-protected-resource`
> - API catalog: `https://afzallokhandwala.com/.well-known/api-catalog`
> - MCP server card: `https://afzallokhandwala.com/.well-known/mcp/server-card.json`

---

## MCP Endpoint

| Property  | Value |
|-----------|-------|
| URL       | `https://afzallokhandwala.com/wp-json/mcp/mcp-adapter-default-server` |
| Transport | Streamable HTTP (MCP spec 2025-11-25) |
| Protocol  | JSON-RPC 2.0 over HTTP POST |
| HTTPS     | yes |

---
## Authentication Methods

### Application Passwords (active)

WordPress Application Passwords provide per-agent, individually-revocable
credentials without requiring a full OAuth setup. They are available on
WordPress 5.6 and later, over HTTPS.

**Steps to obtain credentials:**

1. Ask the site owner to create a dedicated WordPress user for your agent,
   with the lowest role that covers what you need to read.
2. In *Users → Profile* (or *Users → Edit User* for another account), open
   *Application Passwords* → *Add New*.
3. Name the credential after your agent (e.g. `my-agent-prod`). WordPress shows
   that name, the creation date, and the last-used date and IP on the same screen.
4. Copy the generated password — it is shown once and cannot be retrieved later.

**Usage:**

Send HTTP Basic authentication with every MCP request:

```
Authorization: Basic base64(username:application_password)
```

**Permissions:** An application password grants exactly the capabilities of the
WordPress user it belongs to. There is no separate Elementor role or scope to
assign. The discovery documents and Markdown page variants on this site are
public and require no credentials.

---

## Audit Log

All authenticated MCP tool invocations are logged with timestamp, tool name,
agent label (Application Password name), anonymised IP hash, response status,
and duration. Logs are retained for 30 days by default.