# auth.md

You are an agent. This file is a **self-contained registration flow** for AI agents. Complete registration from this document alone; you do not need OAuth metadata first.

This service is a **public content site**. Reading public pages does not require authentication, registration, or paid credentials.

This site is **not** an OpenID Connect Provider and does not publish `/.well-known/openid-configuration`. Authorization Server metadata at `/.well-known/oauth-authorization-server` is **agent_auth discovery only**: there is no OAuth authorization endpoint, token endpoint, or ID token. Registration via `/agent/auth` is optional; public content can be read without it.

## Audience

Agent audience: AI agents that want to read public content on https://ta93abe.com. Browser visitors can ignore this file.

## Contract

Machine-readable registration contract. OAuth metadata is optional; this block is enough to complete the anonymous flow.

```yaml
audience: agent
register_uri: https://ta93abe.com/agent/auth
http_methods:
  - POST
  - GET
  - HEAD
identity_types_supported: ["anonymous"]
anonymous:
  credential_types_supported:
    - none
```

## Self-contained registration flow

Standalone registration — audience, register endpoint, method, and credential use:

1. **Audience** — AI agents (see above).
2. **Supported method** — `anonymous`. `identity_types_supported` is `["anonymous"]`. `anonymous.credential_types_supported` is `["none"]`.
3. **Registration endpoint** — `register_uri` is `https://ta93abe.com/agent/auth`. HTTP method: `POST`.
4. **Credential use** — public read does not require a secret credential. Do not send `Authorization: Bearer` or an `access_token` for HTML pages, `llms.txt`, sitemap, or other public discovery documents on ta93abe.com. Registration returns `credential_type: none`. Treat that as confirmation, not a secret.

Register with an origin-form request (RFC 9112). Absolute-form `POST https://ta93abe.com/agent/auth` is the same endpoint:

```http
POST /agent/auth HTTP/1.1
Host: ta93abe.com
Accept: application/json
Content-Type: application/json

{
  "identity_type": "anonymous"
}
```

Example response:

```json
{
  "identity_type": "anonymous",
  "credential_type": "none",
  "scopes": [
    "public:read"
  ],
  "note": "Public content on ta93abe.com requires no authentication, secret, or bearer token.",
  "resources": {
    "home": "https://ta93abe.com/",
    "llms": "https://ta93abe.com/llms.txt",
    "sitemap": "https://ta93abe.com/sitemap.xml"
  }
}
```

GET returns the same JSON. OPTIONS advertises `Allow: GET, HEAD, POST, OPTIONS`. Do not treat the response as a secret, and do not send a bearer token afterward.

## Step 1 — Discover

Fetch Authorization Server and Protected Resource metadata (optional; this document stays self-contained if they are missing):

```http
GET https://ta93abe.com/.well-known/oauth-authorization-server
GET https://ta93abe.com/.well-known/oauth-protected-resource
```

The Authorization Server `issuer` is `https://ta93abe.com`. Metadata includes an `agent_auth` object. The `skill` field points back to this document.

## Step 2 — Pick a method

Supported identity type: **anonymous**.

Authorization Server metadata advertises `identity_types_supported: ["anonymous"]`, `anonymous.credential_types_supported: ["none"]`, and `anonymous.claim_uri`. No long-lived secret is required to read public content. Prefer the anonymous path. Do not request or attach an API key.

## Step 3 — Register

Call the registration endpoint declared in metadata (`agent_auth.register_uri`):

```http
POST https://ta93abe.com/agent/auth
Accept: application/json
```

The JSON confirms anonymous public access (`credential_type: none`).

## Step 4 — Claim

Anonymous public read does not require a user-in-the-loop claim ceremony. `agent_auth.anonymous.claim_uri` is a no-op that completes immediately and issues no credential.

```http
POST https://ta93abe.com/agent/claim
Accept: application/json
```

GET returns the same JSON. Do not wait for a `user_code`, and do not poll a token endpoint. There is no secret to store.

## Step 5 — Use the credential

No bearer token is required for HTML pages, `llms.txt`, sitemap, or other public discovery documents on ta93abe.com. Do not send an `Authorization` header. There is no `access_token` to store, and `Authorization: Bearer` is ignored because public read uses `credential_type: none`.

## Errors

- `404` — endpoint or resource does not exist
- `405` — unsupported HTTP method on `/agent/auth` or `/agent/claim`

## Revocation

There is nothing to revoke for anonymous public read access.

## Public resources

- Homepage: https://ta93abe.com/
- Sitemap: https://ta93abe.com/sitemap.xml
- llms.txt: https://ta93abe.com/llms.txt
- API catalog: https://ta93abe.com/.well-known/api-catalog
- ARD capability manifest: https://ta93abe.com/.well-known/ai-catalog.json
- MCP server card: https://ta93abe.com/.well-known/mcp/server-card.json
- Agent skills: https://ta93abe.com/.well-known/agent-skills/index.json
- A2A Agent Card: https://ta93abe.com/.well-known/agent-card.json
- security.txt: https://ta93abe.com/.well-known/security.txt