# auth.md

Agent authentication and registration discovery for **Robauto** (https://robauto.ai).

This document tells autonomous agents, crawlers, and MCP clients how to identify
themselves, register, and obtain credentials for Robauto APIs.

## Audience

- Autonomous AI agents and assistants (Claude, ChatGPT, Gemini, custom agents)
- MCP clients connecting to `https://mcp.robauto.ai`
- Server-to-server integrations calling `https://robauto.ai/api/public/*`

## Resource servers

| Resource | Base URL | Auth required |
| --- | --- | --- |
| Public API | `https://robauto.ai/api/public` | No for GET snapshots; Bearer for writes |
| MCP server | `https://mcp.robauto.ai` | Bearer (optional for public tools) |
| Robot Soul identity | `https://robauto.ai/api/soul` | Bearer for writes |

## OAuth metadata

- Protected Resource Metadata: `https://robauto.ai/.well-known/oauth-protected-resource`
- Authorization Server Metadata (RFC 8414): `https://robauto.ai/.well-known/oauth-authorization-server`
- OpenID Connect Discovery: `https://robauto.ai/.well-known/openid-configuration`
- Both mirror the issuer's own documents at `https://hkeytqaukllckucnhzey.supabase.co/auth/v1/.well-known/…`; `issuer` is identical in every copy
- Issuer: `https://hkeytqaukllckucnhzey.supabase.co/auth/v1`
- Bearer methods supported: `header` (`Authorization: Bearer <token>`)
- Scopes supported: `openid`, `profile`, `email`, `offline_access`

```json
{
  "agent_auth": {
    "skill": "auth.md",
    "register_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/clients/register",
    "revocation_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/revoke",
    "claim_uri": "https://robauto.ai/register",
    "identity_types_supported": ["identity_assertion", "anonymous"],
    "methods": [
      {
        "method": "oauth_dynamic_client_registration",
        "register_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/clients/register",
        "authorization_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/authorize",
        "token_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/token",
        "issuer": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1",
        "grant_types_supported": ["authorization_code", "refresh_token"],
        "code_challenge_methods_supported": ["S256"],
        "scopes_supported": ["openid", "profile", "email", "offline_access"],
        "credential_types_supported": ["oauth_client_credentials", "bearer_token"],
        "bearer_methods_supported": ["header"]
      },
      {
        "method": "identity_assertion",
        "identity_assertion": {
          "assertion_types_supported": [
            "urn:ietf:params:oauth:token-type:id-jag",
            "verified_email"
          ],
          "credential_types_supported": ["bearer_token", "jwt"],
          "claim_uri": "https://robauto.ai/register",
          "token_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/oauth/token",
          "issuer": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1",
          "revocation_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/logout",
          "events_supported": [
            "https://schemas.openid.net/secevent/caep/event-type/credential-change",
            "https://schemas.openid.net/secevent/caep/event-type/session-revoked",
            "https://schemas.openid.net/secevent/caep/event-type/token-claims-change"
          ]
        }
      },
      {
        "method": "anonymous",
        "anonymous": {
          "credential_types_supported": ["bearer_token"],
          "claim_uri": "https://robauto.ai/register",
          "token_uri": "https://hkeytqaukllckucnhzey.supabase.co/auth/v1/signup",
          "note": "Anonymous sessions can read public data and run a limited number of scans. Claim the session at claim_uri to persist results."
        }
      }
    ]
  }
}
```

## Using credentials

Send the access token in the `Authorization` header on every request:

```
Authorization: Bearer <access_token>
```

Public GET snapshots under `https://robauto.ai/api/public/` need no credential.
Paid calls follow the x402 flow described at
`https://robauto.ai/.well-known/x402.json`.

## Agent identity (Robot Soul)

Agents that want a permanent, verifiable identity register a Robot Soul:

- Docs: https://robauto.ai/robot-soul
- API: `https://robauto.ai/api/soul/agents/{agent_id}`
- Registry: https://robauto.ai/souls

## Related discovery documents

- https://robauto.ai/.well-known/api-catalog (RFC 9727)
- https://robauto.ai/llms.txt and https://robauto.ai/llms-full.txt
- https://robauto.ai/ai.txt
- https://robauto.ai/openapi.yaml

## Contact

support@robauto.ai — please do not probe registration endpoints during passive
scans; this document is the safe source of truth.