# Bloopbot auth.md

## Audience and supported registration method

This guide is for an AI agent helping a streamer register for the main Bloopbot
platform or sign in to their dashboard. The supported method is user-assisted
Twitch or Kick OAuth sign-in in the streamer's browser. The streamer needs a Twitch or Kick
account and must personally review and approve that platform's permissions.

Registration and channel provisioning start at [the dashboard](https://bloopbot.com/admin).
Its Twitch sign-in button opens [the sign-in endpoint](https://bloopbot.com/admin/oauth/start).
Bloopbot completes the provider callback at https://bloopbot.com/admin/oauth/callback,
creates or links the streamer's channel when sign-ups are open, and starts a
dashboard session. Agents must not construct or replay callback URLs.

Its Kick sign-in button opens [the Kick sign-in endpoint](https://bloopbot.com/auth/kick/start), which
completes at https://bloopbot.com/auth/kick/callback. Signing in with Kick makes a
Kick channel. A streamer who already uses Bloopbot with Twitch adds Kick from
their dashboard's Connections page instead ([Use Bloopbot on Kick](https://bloopbot.com/docs/bloopbot-on-kick)).

## 1. Hand signup to the streamer

1. When the user asks to join Bloopbot, open https://bloopbot.com/admin in their browser.
2. Ask them to choose Twitch or Kick sign-in with the account that owns their channel.
3. Let them review the platform's requested permissions and complete authorization.
4. New channels arrive at their dashboard, where Pebble, Bloopbot's guide,
   offers a first walkthrough. Let the streamer choose what to build and which
   flows to start; signup itself is not approval to run flows.
5. Confirm the dashboard shows the intended channel before helping further.

For example: "Open https://bloopbot.com/admin, sign in with your channel's Twitch or Kick account,
review the permissions, and tell me when your dashboard opens."

If sign-ups are closed, an unconnected channel cannot be added. Existing users
can still sign in, and helpers use their own Twitch accounts with the helper
link the channel owner provides. Never try to bypass the sign-up restriction
or register an agent-owned channel in place of the streamer's channel.

## 2. Use the browser session

Successful sign-in sets an HttpOnly session cookie scoped to /admin; the browser
includes it automatically on dashboard requests. Keep it in the user's browser.
Do not extract it into an agent transcript, URL, log or Authorization header.
Dashboard actions use the signed-in session and the page's CSRF protection.
Follow the UI and perform only actions the user requested.

Main-platform signup does not issue an agent API key or bearer access token.
There is no automated agent registration or credential-provisioning API, and no
anonymous, ID-JAG or verified-email agent credential registration method.
The OAuth discovery documents for MCP and Stream Deck describe separate
integration access, not platform account registration; do not use their client
registration or token endpoints to create a Bloopbot platform account.

## 3. Recover access or sign out

If the session expires, return to https://bloopbot.com/admin and let the user sign in again.
Existing users who previously confirmed a backup sign-in email can choose
Sign in with email instead, at https://bloopbot.com/admin/signin/email. They receive a
sign-in link and press Continue in their browser. Backup email is a recovery
method for an existing account, not email registration for a new account.
Never request sign-in email or consume a sign-in link during a passive scan.

Use Sign out in the dashboard to end the session. The UI submits its protected
POST to https://bloopbot.com/admin/logout with the current session's CSRF token and clears
the session cookie. Do not replay it as a discovery check.

## Passive discovery and further help

GET https://bloopbot.com/auth.md is public, read-only and requires no session. Passive
scanners should read this document and public guides only: even the
sign-in start URLs create temporary state, and email requests send messages.
Do not probe POST /agent/auth or any registration, sign-in or logout action.

Streamer walkthrough: [Get started with Bloopbot](https://bloopbot.com/docs/getting-started).
Recovery: [Keep a backup way to sign in](https://bloopbot.com/docs/backup-sign-in-email).