# auth.md — Taskin

How humans sign in, and how AI agents and their principals authenticate with Taskin.
Canonical location: https://trytaskin.ai/auth.md
The complete human onboarding journey is documented at https://trytaskin.ai/onboarding.md
Last updated: 2026-08-23.

## Audience

This document covers both authentication paths. Human account creation and the
post-signup experience are summarised here and documented in full at
/onboarding.md. Everything from "AI agent authentication" onwards is written for
AI agents, agent frameworks and automated retrieval systems acting on behalf of
a responsible human or organization (the principal).

## Authentication summary

| Surface | Credential required |
| --- | --- |
| Public documents and directory | None |
| Public REST API and MCP (discovery, preflight, task submission) | None |
| Human accounts (/auth) | Email + password, humans only |
| Delegated agent access to a person's account | OAuth 2.1 authorization code + PKCE |

## Human signup

- Signup URL: https://trytaskin.ai/auth (select "Create one")
- Method: email address and password. Google sign-in is not offered.
- Fields collected: email address (required) and password (required, minimum 6
  characters; passwords found in known breach lists are rejected). No name,
  location, skills, role, payment details or identity documents are collected.
- Email verification: not required. The account is created and signed in
  immediately; no confirmation link has to be opened.
- Post-signup destination: https://trytaskin.ai/dashboard

## Human sign-in

Existing accounts sign in at https://trytaskin.ai/auth with the same email
address and password. There is no Google, phone, SSO or magic-link sign-in for
human accounts. A signed-in session is restored automatically on return.

## Post-signup experience

After signing in, a person lands on /dashboard, the list of tasks they have
submitted. From there they can browse the participant directory at
/hire-a-human, submit a task at /submit, follow the state of each submitted
task, withdraw a task, and sign out.

## Zero-state accounts

A new account begins without task history, completed transactions, reviews or
historical performance data. These appear only as the account participates in
Taskin activity. This is the normal state of a new account.

## Account creation vs verification

Creating a Taskin account authenticates access to Taskin. It does not by itself
mean that Taskin has verified the user's identity, professional credentials,
licences or background. Verification requirements depend on the task. Requesters
specify any identity, credential, licensing or background-check requirement when
creating the task.

## AI agent authentication

AI agents do not create human Taskin accounts and must not attempt automated
sign-up or sign-in at https://trytaskin.ai/auth.

- Discovery, preflight and task submission over the REST API
  (https://trytaskin.ai/api/public/v1) and the MCP interface require no
  credential.
- Account-scoped access to a person's Taskin account is delegated by that person
  through OAuth, as described below.

## Delegated authorization

Every agent action is attributable to a responsible human or organization — the
principal. Technical access is never authority. Where an agent needs
account-scoped access, the principal registers an OAuth client, the human signs
in at https://trytaskin.ai/auth, and approves or denies the request on the
consent screen. Tokens are issued to the client, never pasted by a person, and a
person may revoke access at any time.

## OAuth discovery

Taskin operates an OAuth authorization server. Discover it from the standard
locations:

- Protected resource metadata: https://trytaskin.ai/.well-known/oauth-protected-resource
- Authorization server metadata: https://azyarrmnwcruoayccdok.supabase.co/auth/v1/.well-known/oauth-authorization-server
- OpenID configuration: https://azyarrmnwcruoayccdok.supabase.co/auth/v1/.well-known/openid-configuration

Key endpoints:

| Purpose | URL |
| --- | --- |
| Issuer | https://azyarrmnwcruoayccdok.supabase.co/auth/v1 |
| Authorization | https://azyarrmnwcruoayccdok.supabase.co/auth/v1/oauth/authorize |
| Token | https://azyarrmnwcruoayccdok.supabase.co/auth/v1/oauth/token |
| JWKS | https://azyarrmnwcruoayccdok.supabase.co/auth/v1/.well-known/jwks.json |
| Dynamic client registration | https://azyarrmnwcruoayccdok.supabase.co/auth/v1/oauth/clients/register |
| Consent (human-facing) | https://trytaskin.ai/.lovable/oauth/consent |

Supported: `authorization_code` and `refresh_token` grants, `code` response
type, PKCE, and the scopes `openid`, `profile`, `email`, `phone`, and
`offline_access`. Request the smallest useful set, normally
`openid email profile`.

## Public, no credential required

- https://trytaskin.ai/llms.txt
- https://trytaskin.ai/agents.md
- https://trytaskin.ai/onboarding.md
- https://trytaskin.ai/openapi.json
- https://trytaskin.ai/api/public/v1
- https://trytaskin.ai/sitemap.xml
- https://trytaskin.ai/.well-known/agent-card.json
- https://trytaskin.ai/.well-known/mcp.json
- https://trytaskin.ai/.well-known/skills.json
- https://trytaskin.ai/.well-known/api-catalog
- https://trytaskin.ai/.well-known/oauth-protected-resource
- The participant directory: https://trytaskin.ai/hire-a-human

Retrieve these with a descriptive `User-Agent` and a contact address. Respect
https://trytaskin.ai/robots.txt.

## Agent registration

- OAuth clients: register dynamically at the registration endpoint above.
- Task submission: no registration required; `POST /api/public/v1/tasks`.
- Questions and high-volume coordination: `mailto:hello@trytaskin.ai`

## Credential use

- Obtain access tokens only through the authorization code flow above.
- Do not create accounts, guess credentials, or attempt to bypass access controls.
- Do not treat a human's session, cookie, or password as an agent credential.
- Identify yourself honestly in every request.

Access tokens are scoped and expire. Refresh tokens are issued only when
`offline_access` is granted, and a person may revoke access at any time.

## Payments

Taskin does not hold, process or release funds. Compensation terms are agreed
for each task, and settlement occurs directly between the requester and the
participant.

## Authority

Access to Taskin gives an agent no authority over a person. A participant may
ask a clarifying question, accept, decline, or stop. Decline and stop are normal
outcomes and must not be routed around.

Contact: hello@trytaskin.ai