# auth.md

This service publishes OAuth and OpenID Connect discovery metadata for agent
compatibility. It is a discovery-only surface and does not create accounts,
issue credentials, or accept registration.

## Audience

Agents reading this document can use the public site and its read-only discovery
interfaces. No authenticated write API is offered.

## Discovery

- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
- OpenID Connect metadata: `/.well-known/openid-configuration`
- JSON Web Key Set: `/.well-known/jwks.json`

## Registration and credentials

`/agent/auth` and `/oauth/authorize` return a standard unavailable error. The
token endpoint returns `temporarily_unavailable`. These endpoints never create
accounts, issue credentials, or persist registration data.

The advertised registration method is `oauth-authorization-code` at
`/agent/auth`, with status `unavailable`.

## ID-JAG

The ID-JAG identity-assertion flow is published for discovery compatibility.
This service does not issue identity assertions, credentials, or revocations.

## Verified email

The verified-email identity-assertion flow is published for discovery
compatibility. This service does not verify email addresses or issue credentials.

## Anonymous

The anonymous flow is published for discovery compatibility. This service does
not provision anonymous credentials or persist agent registrations.