# Tailorgame authentication

## Public access

GET /api/games without cookies returns public games. GET /api/rankings and the MCP tools are public. No API key, account, payment method, or OAuth grant is needed for these reads.

## Interactive account access

People sign in at [Sign in](https://tailorgame.com/sign-in). Firebase Authentication supplies the enabled sign-in providers, including verified email/password and configured social providers. GET /api/auth/config returns the runtime public Firebase configuration and enabled provider list. Email/password accounts must verify their email.

The website uses Firebase's client SDK with in-memory persistence. A recent sign-in (within five minutes) supplies an ID token. The browser first calls GET /api/auth/csrf and retains the returned HTTP-only CSRF cookie and csrfToken value. It then POSTs {"idToken":"<recent Firebase ID token>"} to /api/auth/session, with Content-Type: application/json, the matching x-csrf-token header, and the site's Origin. The server verifies the token, provider, account, and email requirements before issuing an HTTP-only, SameSite=Lax tailorgame-session cookie for up to five days. The cookie is Secure in production.

GET /api/auth/session returns {user: null} when signed out. DELETE /api/auth/session requires the same CSRF cookie/header and Origin and clears the session cookie. Sign out on the website when finished.

## Authorization and permissions

Account API operations require the person's session. Mutations also enforce the configured site origin. Game briefs, credit history, profile details, rooms and private games remain protected by server-side ownership and membership checks. Signed-out account requests return JSON errors with HTTP 401. Unauthorized origins return 403.

The public MCP server has public-read access only and deliberately ignores session credentials. Tailorgame does not currently offer delegated agent OAuth, API keys, service-account access, dynamic client registration, or selectable OAuth scopes. Browser social sign-in is not a delegated agent authorization endpoint. Do not copy credentials out of the browser or send them to a third party.

Updated: 2026-11-05.

## Resources

- [Documentation](https://tailorgame.com/docs)
- [OpenAPI 3.1](https://tailorgame.com/openapi.json)
- [Documentation index](https://tailorgame.com/llms.txt)
- [Authentication](https://tailorgame.com/auth.md)
- [Pricing](https://tailorgame.com/pricing.md)