# BigBooks

> BigBooks is the secure financial data platform behind personal finance apps. It connects to financial institutions, manages your financial records, and gives you one account across participating apps while keeping you in control of who can access your information.

This domain hosts account sign-in/sign-up and the OAuth 2.0 / OpenID Connect authorization server. The REST API and MCP server live at https://api.bigbooks.app. All API endpoints under https://api.bigbooks.app/v1/ require an OAuth 2.0 bearer token issued by this authorization server. Use the discovery documents below — they are the canonical, machine-readable source of truth for endpoints and capabilities.

## Authentication

- [Sign in](https://www.bigbooks.app/login)
- [Sign up](https://www.bigbooks.app/user/signup)
- [OAuth clients](https://www.bigbooks.app/clients): create a client_id for API access (sign-in required; new clients are public with PKCE by default)
- [OpenID Connect discovery](https://www.bigbooks.app/.well-known/openid-configuration): OIDC provider configuration
- [OAuth 2.0 authorization server metadata](https://www.bigbooks.app/.well-known/oauth-authorization-server): RFC 8414 discovery — authorization, token, and JWKS endpoints

## CORS

- API endpoints (https://api.bigbooks.app/v1/) allow any origin (Access-Control-Allow-Origin: *); authentication is by bearer token, never cookies. Preflights allow any requested headers (e.g. Authorization, X-Acting-Party-ID), and the ETag and Last-Modified response headers are exposed so browser clients can read the version needed for If-Match.
- Authorization server endpoints on this domain (https://www.bigbooks.app/oauth2/*, including token and userInfo) allow only a per-origin allow-list derived from the web origins of active registered clients' redirect URIs. Requests from any other origin are rejected with 403 "Invalid CORS request". (https://www.bigbooks.app/oauth2/authorize is exempt: it is a top-level browser redirect, not a fetch, so CORS never applies.)
- The discovery documents (https://www.bigbooks.app/.well-known/openid-configuration, https://www.bigbooks.app/.well-known/oauth-authorization-server) and JWKS (https://www.bigbooks.app/oauth2/jwks) are public metadata and allow any origin (Access-Control-Allow-Origin: *).
- To call them from a browser, the page's origin must exactly match a registered redirect URI's origin — scheme, host, and port (http://localhost:5000 and http://127.0.0.1:5000 are different origins; pages opened via file:// send Origin: null, which can never be allowed).
- Add or change redirect URIs at [OAuth clients](https://www.bigbooks.app/clients); the allow-list updates within about a minute, no redeploy.

## API

- [Integrator guide](https://api.bigbooks.app/docs/integrator-guide.md): conventions (tenancy, concurrency, errors, pagination) and a domain glossary — read this first
- [OpenAPI specification](https://api.bigbooks.app/v3/api-docs): machine-readable description of the REST API (OpenAPI 3)
- [Swagger UI](https://api.bigbooks.app/swagger-ui/index.html): browsable API documentation
- [MCP server metadata](https://api.bigbooks.app/.well-known/mcp.json): Model Context Protocol discovery — server endpoint, transport, and OAuth requirements for MCP clients

## Legal

- [Privacy Policy](https://www.bigbooks.app/privacy): what BigBooks collects, how AI features and Connected Apps handle data, sharing, retention, and your rights
- [Terms of Use](https://www.bigbooks.app/terms): the agreement governing accounts, financial institution connections, developer/API access, AI features, and liability