# auth.md

> Agent registration and authentication discovery metadata for Eco-Theory Store (`https://eco-theory.com`).
> Handcrafted artisan soaps, natural skincare, and clean ingredients.
> Operator Contact: <mailto:andrewlawler@eco-theory.com>

## Agent Registration

Eco-Theory Store publishes public API access and automated services for AI agents and developer integrations.
Public storefront browsing (`/api/shop/products`, `/api/maintenance`, `/openapi.json`) does not require authentication credentials.
For agentic purchasing, reviews, or integration attribution, agents discover authentication posture through standard OAuth Protected Resource Metadata (PRM) and Authorization Server metadata.

- **Resource Server**: `https://eco-theory.com`
- **Authorization Server**: `https://eco-theory.com`
- **API Catalog**: `https://eco-theory.com/.well-known/api-catalog`
- **OpenAPI Specification**: `https://eco-theory.com/openapi.json`
- **API Documentation**: `https://eco-theory.com/api/docs`

## Discovery

Agents should inspect these discovery documents in sequence:
1. **Protected Resource Metadata (PRM)**: `https://eco-theory.com/.well-known/oauth-protected-resource` (RFC 9728)
2. **OAuth Authorization Server Metadata**: `https://eco-theory.com/.well-known/oauth-authorization-server` (RFC 8414) containing the `agent_auth` configuration block.
3. **Web Bot Auth HTTP Message Signatures Directory**: `https://eco-theory.com/.well-known/http-message-signatures-directory` (IETF HTTP Message Signatures Directory) for cryptographic bot verification.

## Supported Identity Types

- **anonymous**: Public read-only browsing of products, reviews, and stock. No user account required. Optional agent API key may be issued on request for request attribution and rate-limit allocations.
- **identity_assertion**: Operator or agent identity assertion backed by:
  - `urn:ietf:params:oauth:token-type:id-jag` (Identity Assertion JSON Web Token)
  - `verified_email` (Operator email confirmation)

## Scopes

- `read:products`: Browse products, ingredients, pricing, and batch records.
- `read:orders`: View status of authenticated orders.
- `write:reviews`: Submit customer product reviews.
- `write:checkout`: Calculate tax, shipping rates, and process order payments.

## Endpoints

- **Registration URI**: `https://eco-theory.com/api/agent/auth/register`
- **Claim URI**: `https://eco-theory.com/api/agent/auth/claim`
- **Revocation URI**: `https://eco-theory.com/api/agent/auth/revoke`

## Manual Agent Inquiries

Operators may also register or claim autonomous agent integrations by contacting <mailto:andrewlawler@eco-theory.com> with:
- Agent identifier and software client description
- Operator legal identity and contact email
- Intended usage, concurrency, and request rate requirements