# SABO HUB — Authentication for agents and integrations

**Site:** https://hub.sabo.com.vn  
**Protected API prefix:** `https://hub.sabo.com.vn/api/`  
**Supabase project:** `dqddxowyikefqcdiioyh`  
**Authorization server (Supabase Auth):** `https://dqddxowyikefqcdiioyh.supabase.co/auth/v1`

## Discovery endpoints (start here)

| Document | URL | Purpose |
| --- | --- | --- |
| API catalog (RFC 9727) | `GET /.well-known/api-catalog` | Linkset of API endpoints (`Accept: application/linkset+json`) |
| Service description (OpenAPI 3.1) | `GET /.well-known/api-service-desc.json` | Machine-readable route list and auth schemes |
| OpenID configuration | `GET /.well-known/openid-configuration` | OIDC metadata (Supabase Auth issuer) |
| OAuth authorization server | `GET /.well-known/oauth-authorization-server` | RFC 8414 metadata for token acquisition |
| OAuth protected resource | `GET /.well-known/oauth-protected-resource` | Which auth server protects `/api` |
| MCP server card | `GET /.well-known/mcp/server-card.json` | MCP discovery for REST + WebMCP surface |
| Agent skills index | `GET /.well-known/agent-skills/index.json` | Skill packages with SHA-256 digests |
| Auth guide (this file) | `GET /auth.md` | Human + agent registration instructions |

## Human login flows

### CEO / company owner (Supabase Auth)

1. Sign in with email (Google OAuth or magic link) at `/login`, or arrive via SSO from `sabo.com.vn/portal` → `/auth/sso`.
2. Browser receives Supabase session (`access_token`, `refresh_token`).
3. Dashboard routes under `/dashboard`, `/ceo/*`, etc. require this session.

### Employee (company credentials)

1. Staff use `/staff-login` with **company name**, **username**, and **password**.
2. Backend RPC `employee_login` validates credentials; session is stored client-side (not `auth.users`).
3. **Do not** use `supabase.auth.getUser()` for employee identity — use the employee session from the app auth layer.

## Agent / API access

### Step 1 — Discover

```http
GET /.well-known/api-catalog HTTP/1.1
Host: hub.sabo.com.vn
Accept: application/linkset+json
```

```http
GET /.well-known/agent-skills/index.json HTTP/1.1
Host: hub.sabo.com.vn
```

Verify skill integrity: compare `digest` in the index against `sha256:` + hex hash of the skill file bytes.

### Step 2 — Obtain tokens

- Read `/.well-known/openid-configuration` for `authorization_endpoint`, `token_endpoint`, and `jwks_uri`.
- Read `/.well-known/oauth-protected-resource` to confirm `https://hub.sabo.com.vn/api` is protected by `https://dqddxowyikefqcdiioyh.supabase.co/auth/v1`.

Obtain a **Bearer access token** from Supabase Auth. Send on CEO API requests:

```http
Authorization: Bearer <access_token>
```

### Step 3 — Call APIs

See `/.well-known/api-service-desc.json` for paths. Primary agent-facing routes:

| Route | Methods | Auth |
| --- | --- | --- |
| `/api/sabo-ai/chat` | POST | Bearer (CEO) or `x-employee-id` |
| `/api/sabo-ai/health` | GET | None |
| `/api/ceo/morning-brief` | GET | Bearer |
| `/api/ceo/money-pulse` | GET | Bearer |
| `/api/ceo/key-pool` | GET, POST, PATCH, DELETE | Bearer |
| `/api/hitl/ingest` | POST | Bearer |
| `/showcase.json` | GET | None |

### Public (no auth)

- `GET /showcase.json` — public case-study metrics
- `GET /.well-known/*` — discovery documents
- `GET /sitemap.xml`
- Landing pages `/`, `/solutions/*`

### Server-only (not for agents)

- `/api/cron` — requires `CRON_SECRET`
- `/api/arena-pro-webhook`, `/api/hitl/telegram` — channel webhook secrets
- Legacy alias: `/api/zalo-oa-webhook` → `/api/hitl/telegram?_channel=zalo`

## SABO AI gateway

- Base URL: `https://hub.sabo.com.vn/api/sabo-ai`
- Chat: `POST /api/sabo-ai/chat`
- Health: `GET /api/sabo-ai/health`
- Legacy alias: `/api/ceo/ai-chat` → `/api/sabo-ai/chat`

## Registration for new companies

New tenants are provisioned by **SABO M&T** (sabo.com.vn) — not self-serve signup for production verticals. Contact via https://sabo.com.vn or https://hub.sabo.com.vn/support.

OAuth client registration for third-party agents uses Supabase Auth at `https://dqddxowyikefqcdiioyh.supabase.co/auth/v1` (see `registration_endpoint` in authorization-server metadata when enabled).

## WebMCP (in-browser tools)

On the homepage, supporting browsers expose `document.modelContext.registerTool()` tools for site navigation and catalog lookup (`list_solutions`, `get_api_catalog_url`, `get_auth_doc_url`). No separate MCP HTTP transport is required for those tools.

## Security notes

- Never commit service-role keys or `.env` secrets.
- Employee passwords are managed via RPC `change_employee_password`, not Supabase Auth admin APIs.
- Row-level access is company-scoped; always pass the correct company context.
- Production Supabase instance: `dqddxowyikefqcdiioyh` — do not switch projects.