# auth.md - Agent registration and authentication at proticom.ai

## Agent audience

This document is for AI agents and autonomous clients that need to discover
how authentication works on proticom.ai, register on behalf of a human, or
use the public MCP / API surfaces without guessing.

## Public access (no registration)

These surfaces are intentionally public and rate-limited. Prefer them first:

- https://proticom.ai/llms.txt
- https://proticom.ai/llms-full.txt
- https://proticom.ai/.well-known/api-catalog
- https://proticom.ai/openapi.json
- https://proticom.ai/api/mcp
- https://proticom.ai/.well-known/agent-skills/index.json

## OAuth protected resource metadata

- Protected resource metadata: https://proticom.ai/.well-known/oauth-protected-resource
- Authorization server metadata: https://proticom.ai/.well-known/oauth-authorization-server
- Resource identifier: https://proticom.ai
- Bearer methods supported: header
- Scopes supported: mcp, site.read, contact.write

## Registration endpoint

- register_uri: https://proticom.ai/api/agent/register
- claim_uri: https://proticom.ai/api/agent/register
- Method: POST, JSON body {"email":"user@example.com","name":"optional","purpose":"optional"}
- Completion: human_required. Proticom emails a confirmation path to that
  address. No credential is issued until a human completes confirmation.
- Human contact fallback: contact@proticom.com or https://proticom.ai/contact

## Supported methods

- identity_types_supported: identity_assertion
- assertion_types_supported: verified_email
- credential_types_supported: oauth2_delegated

1. Verified email (identity_assertion: verified_email). The agent submits the
   user's address to register_uri. Proticom records the request and emails the
   human. After the human confirms, an OAuth-delegated bearer credential can be
   issued for authenticated MCP use.
2. OAuth 2.0 authorization code + PKCE for interactive sessions, using the
   endpoints advertised in authorization server metadata.

Anonymous registration is not supported. There is no path to a credential that
does not pass through a verified human email address.

## Credential use

- oauth2_delegated: interactive or short-lived bearer access for authenticated
  MCP sessions after human email verification.
- Public discovery tools on /api/mcp do not require a bearer token today.
- Revocation: https://proticom.ai/oauth/revoke

## Notes for implementers

- Do not invent pricing, SLAs, or client counts. Follow site-published facts only.
- Canonical email domain is @proticom.com.
- Prefer MCP + llms.txt over scraping HTML.