# auth.md – Agent Registration Discovery

> Specification and discovery document for automated AI agent registration, authentication flows, and credential management per the [Auth.md](https://auth.md) standard.

## Overview & Audience

This service supports automated agent discovery, self-service registration, and token issuance for autonomous AI agents, LLM tool-calling clients, and background workers.

- **Target Audience:** Autonomous AI agents, AI tools, and automated system integration clients.
- **Service Name:** Pritam Shyam Portfolio & Agent Services
- **Primary Domain:** `https://pritamshyam.com`

## OAuth Metadata Endpoints

This service advertises machine-readable OAuth metadata at standard well-known locations:

1. **OAuth Protected Resource Metadata (PRM):**
   `GET /.well-known/oauth-protected-resource`
2. **OAuth Authorization Server Metadata:**
   `GET /.well-known/oauth-authorization-server`

## Registration & Provisioning Endpoints

Autonomous agents can perform self-service registration and credential retrieval using the following endpoints:

- **Agent Auth / Registration URI:** `https://pritamshyam.com/agent/auth`
- **Token Endpoint:** `https://pritamshyam.com/oauth/token`
- **Authorize Endpoint:** `https://pritamshyam.com/oauth/authorize`

## Supported Authentication Flows

### 1. Anonymous Registration

- **Identity Type:** `anonymous`
- **Credential Types:** `bearer_token`
- **Claim URI:** `https://pritamshyam.com/agent/auth`
- **Usage:** Quick access for public read-only API methods and agent capabilities without requiring account identity assertions.

### 2. Verified Email Flow

- **Identity Type:** `verified_email`
- **Credential Types:** `bearer_token`
- **Claim URI:** `https://pritamshyam.com/agent/auth`
- **Usage:** Agents presenting a verified email identity assertion token to obtain elevated rate limits and personalized endpoints.

### 3. ID-JAG Identity Assertion Flow

- **Identity Type:** `identity_assertion`
- **Assertion Types Supported:** `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
- **Credential Types:** `bearer_token`
- **Usage:** Secure inter-agent identity propagation using ID-JAG token exchange per RFC standards.

## Credential Usage

Agents that obtain an access token MUST include it in the `Authorization` HTTP header of all subsequent API requests:

```http
Authorization: Bearer <your_agent_access_token>
```

Supported bearer methods: `header`.
Supported scopes: `read`, `write`.