# auth.md

You are an agent. Mug Factory supports **agentic registration discovery**: discover → register → (claim if needed) → exchange for an access_token → call API.

## Step 1 — Discover

### 1a. Protected Resource Metadata

`GET https://www.mugfactory.in/.well-known/oauth-protected-resource`

- `resource`: `https://www.mugfactory.in/`
- `authorization_servers`: `["https://www.mugfactory.in"]`
- `bearer_methods_supported`: `["header"]`

### 1b. Authorization Server metadata (includes `agent_auth`)

`GET https://www.mugfactory.in/.well-known/oauth-authorization-server`

Read the `agent_auth` block in full. Key fields:

- `agent_auth.skill` — this document
- `agent_auth.register_uri` / `identity_endpoint` — `https://www.mugfactory.in/agent/identity`
- `agent_auth.claim_endpoint` — `https://www.mugfactory.in/agent/identity/claim`
- `agent_auth.identity_types_supported` — `anonymous`, `identity_assertion`, `service_auth`
- `token_endpoint` — `https://www.mugfactory.in/oauth2/token`
- `revocation_endpoint` — `https://www.mugfactory.in/oauth2/revoke`

## What is public without OAuth?

| Surface | Auth |
| --- | --- |
| `GET /api/products`, `GET /api/reviews`, `GET /api/status`, `POST /mcp` | None |
| `POST /api/contact`, `POST /api/business-inquiry` | Cloudflare Turnstile (not OAuth) |
| Customer browser account | Supabase Auth (human OIDC) via [/login](https://www.mugfactory.in/login) |

## Agent registration status

Automated credential issuance for third-party agents is **discoverable** via the endpoints above. Production partner access is provisioned manually:

1. Prefer public MCP tools at `https://www.mugfactory.in/mcp` for catalog and company facts.
2. Email **enquiry@mugfactory.in** with agent identity, redirect/claim URIs, and requested scopes (`catalog.read`, `quotes.write`).
3. Humans create shopper accounts at [/login](https://www.mugfactory.in/login).

## Preferred entrypoints

- API catalog: `/.well-known/api-catalog`
- OpenAPI: `/docs/api/openapi.json`
- Skills index: `/.well-known/agent-skills/index.json`
- MCP server card: `/.well-known/mcp/server-card.json`
- LLMs.txt: `/llms.txt`