# auth.md

You are an agent. Edenspiekermann supports anonymous agent registration for public site resources. Registration does not create a user account, does not grant private data access, and does not authorize actions outside the public website, public jobs API, public MCP server, and explicit user-directed contact inquiries.

## Step 1 - Discover

Fetch the Protected Resource Metadata:

```http
GET https://www.edenspiekermann.com/.well-known/oauth-protected-resource
```

Then fetch the Authorization Server metadata listed in `authorization_servers[0]`:

```http
GET https://www.edenspiekermann.com/.well-known/oauth-authorization-server
```

The Authorization Server metadata contains the `agent_auth` block with:

- `skill`: https://www.edenspiekermann.com/auth.md
- `register_uri`: https://www.edenspiekermann.com/agent/auth
- `revocation_uri`: https://www.edenspiekermann.com/agent/auth/revoke
- `identity_types_supported`: `anonymous`
- `anonymous.credential_types_supported`: `access_token`

## Step 2 - Pick a method

Use `anonymous` registration. Edenspiekermann does not currently accept ID-JAG identity assertions or verified-email claim ceremonies for this public site.

## Step 3 - Register

```http
POST https://www.edenspiekermann.com/agent/auth
Content-Type: application/json

{
  "type": "anonymous",
  "requested_credential_type": "access_token",
  "requested_scopes": ["public.read", "jobs.read", "case_studies.read"]
}
```

Successful response:

```json
{
  "registration_id": "reg_...",
  "registration_type": "anonymous",
  "credential_type": "access_token",
  "access_token": "espi_public_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "public.read jobs.read case_studies.read"
}
```

The access token is an agent-registration credential for public resources only. Public endpoints may also be readable without credentials.

## Step 4 - Use the credential

Send the credential as a bearer token when calling public APIs or MCP transports that accept an `Authorization` header:

```http
Authorization: Bearer espi_public_...
```

Useful public resources:

- MCP endpoint: https://www.edenspiekermann.com/mcp
- Jobs API and docs: discover from https://www.edenspiekermann.com/llms.txt
- Public pages: request `Accept: text/markdown` on content pages when Markdown is preferred.

## Scopes

- `public.read`: Read public Edenspiekermann site content and discovery files.
- `jobs.read`: Read public jobs data from the jobs API and MCP tools.
- `case_studies.read`: Read public case study references and details.
- `contact.submit`: Submit a contact inquiry only when the user explicitly asks to contact Edenspiekermann.

## Revocation

To discard an issued public access token:

```http
POST https://www.edenspiekermann.com/agent/auth/revoke
Content-Type: application/json

{
  "token": "espi_public_..."
}
```

Revocation is idempotent. Because tokens grant only public-resource access, the endpoint returns success even when the token is already expired or unknown.

## Errors

| Code | Where | What to do |
| --- | --- | --- |
| `unsupported_identity_type` | `https://www.edenspiekermann.com/agent/auth` | Use `anonymous`. |
| `unsupported_credential_type` | `https://www.edenspiekermann.com/agent/auth` | Request `access_token`. |
| `invalid_request` | `https://www.edenspiekermann.com/agent/auth`, `https://www.edenspiekermann.com/agent/auth/revoke` | Send a JSON object with the documented fields. |
| `rate_limited` | any endpoint | Back off and retry later. |

## Policies and contact

- Privacy policy: https://www.edenspiekermann.com/privacy-policy
- Legal notice: https://www.edenspiekermann.com/imprint
- Integration or business contact: https://www.edenspiekermann.com/get-in-touch