# Jules auth.md

This document is for agents and OAuth clients connecting an existing Jules account to the Jules MCP service. Jules does not support silent account creation, anonymous agent accounts, or identity-assertion provisioning.

## 1. Discover the OAuth service

- Protected resource: `https://jules-chatgpt-app-production.up.railway.app/mcp`
- Protected Resource Metadata: `https://jules-chatgpt-app-production.up.railway.app/.well-known/oauth-protected-resource/mcp`
- Authorization server: `https://jules-chatgpt-app-production.up.railway.app/`
- Authorization Server Metadata: `https://jules-chatgpt-app-production.up.railway.app/.well-known/oauth-authorization-server`

Treat the JSON metadata documents as authoritative if they differ from this guide.

## 2. Register an OAuth client

Jules supports OAuth 2.0 Dynamic Client Registration for public clients. This registers client software; it does not create a Jules user or grant access to an account.

```http
POST /register HTTP/1.1
Host: jules-chatgpt-app-production.up.railway.app
Content-Type: application/json

{
  "client_name": "Example agent",
  "redirect_uris": ["https://agent.example.com/oauth/callback"],
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}
```

Use the returned `client_id` for authorization. Never publish client credentials or user tokens.

## 3. Connect an existing Jules account

Start the authorization-code flow at the advertised `authorization_endpoint` and use PKCE with `S256`. Request the Jules MCP resource and only the scopes needed:

- `jules.read`: view the connected user's reminders.
- `jules.write`: create, update, or cancel reminders for the connected user.

Authorization requires an existing Jules account, an eligible Routine subscription, and explicit approval by the user. Phone verification and the Jules onboarding rules remain authoritative. Agents must not attempt to bypass the browser approval step.

Jules does not currently support `anonymous`, `verified_email`, or ID-JAG agent-registration methods.

## 4. Exchange and use credentials

Exchange the authorization code at the advertised `token_endpoint`, including the PKCE `code_verifier` and the same protected-resource identifier used during authorization.

Send the resulting access token only in the HTTP authorization header:

```http
Authorization: Bearer ACCESS_TOKEN
```

Use refresh tokens only at the advertised token endpoint. Revoke credentials through the advertised `revocation_endpoint` when a connection is removed or compromised.

## 5. Safety and support

Jules creates reminders delivered by phone call. Do not use it for emergencies, bulk calling, unsolicited calls, or safety-critical notification systems. Obtain the user's confirmation before creating or materially changing reminders.

- Developer documentation: https://www.heyjules.app/developers
- Privacy: https://www.heyjules.app/privacy
- Terms: https://www.heyjules.app/terms
- Contact: https://www.heyjules.app/contact