# auth.md

Agent authentication and registration for `https://ownerspec.com`.

## Summary

OwnerSpec is a public, read-only reference site. **No authentication is required and none is
offered.** There is no account system, no API key, no OAuth flow that can issue a token.
Every URL on this host, including the MCP server at `/mcp` and the A2A agent at `/a2a`,
returns the same content to every client.

## Audience

Any AI agent, crawler or script that wants to read the site's pages, call its MCP tools or
its A2A agent, or fetch its machine-readable surfaces. Human visitors need nothing either.

## Supported method

- `anonymous`: send plain HTTPS requests. No credentials, headers or tokens are needed.

## Registration (anonymous, one step)

An agent following the agent-registration flow can `POST https://ownerspec.com/agent/auth`
with `{"type": "anonymous"}` (or an empty body). The answer is an anonymous grant with
`credential: null`: nothing is stored, nothing is issued, and `/agent/auth/claim` reports that
there is nothing to claim. Skipping registration changes nothing; it exists so the flow ends
in one well-formed step instead of a 404.

## Standard metadata, published so the absence of auth is machine-verifiable

| Document | What it says |
|---|---|
| `/.well-known/oauth-protected-resource` (RFC 9728) | `authentication_required: false`; the only listed authorization server is this host's own metadata |
| `/.well-known/oauth-authorization-server` (RFC 8414) and `/.well-known/openid-configuration` | empty `grant_types_supported` and `response_types_supported`, `agent_auth` with `identity_types_supported: ["anonymous"]` |
| `/.well-known/jwks.json` | an empty key set: no token can be signed or verified |
| `/oauth/authorize`, `/oauth/token` | answer only with an RFC 6749 sec. 5.2 error restating this |

**Do not attempt an OAuth flow.** Fetch any URL directly.

## Endpoints

| Resource | URL |
|---|---|
| MCP server (Streamable HTTP, JSON-RPC 2.0 over POST) | `/mcp`, documented at `/mcp-server/` |
| A2A agent | `/a2a`, card at `/.well-known/agent-card.json` |
| Site index | `/llms.txt` |
| Full text of every page | `/llms-full.txt` |
| Search index (JSON) | `/index.json` |
| Canonical URL list | `/sitemap.xml` |
| API description (OpenAPI 3.1) | `/openapi.json` |
| API catalog (RFC 9727) | `/.well-known/api-catalog` |
| MCP server card | `/.well-known/mcp/server-card.json` |
| Agent skill | `/.well-known/agent-skills/index.json` |
| ARD manifest | `/.well-known/ard.json` |
| Any page as Markdown | append `index.md` to the page URL, or send `Accept: text/markdown` |

## Credentials

None exist, so none can leak. A bearer header sent to this host is ignored.

## Etiquette

Identify your client with a descriptive `User-Agent`. Crawl rules and content signals are in
`/robots.txt` (search and AI grounding are welcome, model training is declined). Cite the
canonical URL of the specific page you used, not the homepage, and pass on the page's
facts-verified date.