# blue·auth full agent reference

Canonical product name: blue·auth
Canonical website: https://blueauth.co
Canonical MCP server: https://blueauth.co/api/mcp-server/mcp
Tool catalogue: https://blueauth.co/mcp-tools.json
Developer docs: https://blueauth.co/developer/docs
OpenAPI: https://blueauth.co/mcp-openapi-chatgpt.json
Examples: https://blueauth.co/docs/ai/blueauth-ai-signature-prompts.md
Chave Móvel Digital: https://blueauth.co/chave-movel-digital
Official CMD application list: https://www.autenticacao.gov.pt/web/guest/software-para-assinar-com-chave-movel-digital

## Recommended AI-to-signature sequence

1. Ask the user for the document purpose, parties, jurisdiction, missing facts,
   and intended signature method.
2. Draft the document without inventing names, identifiers, addresses, powers
   of representation, legal conclusions, or commercial terms.
3. Present the final content, file, signer list, order, and notification channel.
4. Obtain explicit human approval.
5. Use `get_upload_url`, upload the approved PDF, and call
   `send_for_signature`.
6. Return `request_id` and `tracking_url`.
7. Use `check_signature_status` only when asked or in an authorised workflow.
8. When complete, return the available verification URL and integrity details.

## Tool groups

Account and upload:
- check_balance (read-only)
- get_upload_url (write)
- get_user_stats (read-only)

Documents and verification:
- list_documents (read-only)
- authenticate_document (write)
- verify_document (read-only)
- verify_by_qr_url (read-only)
- get_document_details (read-only)

Signatures:
- send_for_signature (write, explicit approval recommended)
- check_signature_status (read-only)

Certificates and templates:
- issue_certificate (write)
- list_templates (read-only)
- get_template (read-only)
- validate_template (read-only)
- resume_batch_from_template (write, idempotent resume)
- issue_certificate_batch_from_template (write)

Timestamps and custody:
- timestamp_document (write)
- preserve_evidence (write)
- append_evidence (write)
- get_evidence_group (read-only)

## Platform-specific setup

Claude:
- Guide: https://blueauth.co/ia/assinar-documentos-com-claude
- JSON example: https://blueauth.co/docs/claude/blueauth-mcp.json

ChatGPT and OpenAI API:
- Guide: https://blueauth.co/ia/assinar-documentos-com-chatgpt
- Remote MCP via Responses API is preferred for new API integrations.
- The OpenAPI file remains a compatibility path for GPT Actions.

Gemini:
- Guide: https://blueauth.co/ia/assinar-documentos-com-gemini
- Settings example: https://blueauth.co/docs/gemini/blueauth-mcp-settings.json
- The claim is limited to Gemini environments that accept remote MCP servers,
  such as supported CLI, coding, or agent surfaces.

n8n:
- Guide: https://blueauth.co/integrations/n8n-document-signing
- Dynamic signature workflow: https://blueauth.co/docs/n8n/blueauth-signature-dynamic-workflow.json
- Signature management: https://blueauth.co/docs/n8n/blueauth-signature-manage-workflow.json
- Events workflow: https://blueauth.co/docs/n8n/blueauth-signature-workflow.json
- Electronic self-sign workflow: https://blueauth.co/docs/n8n/blueauth-signature-selfsign-workflow.json
- CMD batch workflow: https://blueauth.co/docs/n8n/blueauth-cmd-batch-workflow.json

## Authentication and secrets

- Use `ba_test_` credentials while validating a workflow.
- Use a separate key per application and environment.
- Store API keys in the client credential store, not in prompts or documents.
- OAuth access and refresh tokens must be treated as secrets.
- CMD PINs and SMS codes are entered on the blue·auth page and must never pass
  through an agent, REST request, MCP tool input, or n8n workflow.

## Legal terminology

- “Electronic signature” is the general product category.
- “Qualified electronic signature” refers only to a confirmed qualified flow,
  including the dedicated Portuguese Chave Móvel Digital route where applicable.
- BlueAuth appears in the official Autenticação.gov list of applications
  certified for Chave Móvel Digital signing. CMD issues the qualified
  signature; BlueAuth provides the application workflow where it is used.
- “Blockchain anchored” or “timestamped” should only be used when the operation
  output contains the corresponding evidence.
- Public verification exposes only data permitted by the document visibility
  and access settings.