# auth.md

This document describes how AI agents **would** register with **Bryce Kirk** when programmatic access is offered. **OAuth `POST` registration endpoints are not live** and return no credentials.

The public contact API **is** live: `POST https://www.brycekirk.com/api/contact` (see [llms.txt](https://www.brycekirk.com/llms.txt)). It does not issue tokens.

- **Resource server (site):** `https://www.brycekirk.com/`
- **Authorization server (same origin, stub):** `https://www.brycekirk.com/`

## 1. Discover

1. Fetch Protected Resource Metadata (RFC 9728):

   `GET https://www.brycekirk.com/.well-known/oauth-protected-resource`

2. Read `authorization_servers[0]`, then fetch Authorization Server metadata (RFC 8414):

   `GET https://www.brycekirk.com/.well-known/oauth-authorization-server`

3. Read the `agent_auth` block: `register_uri`, `claim_uri`, `revocation_uri`, `identity_types_supported`, and each `*_supported` array before attempting registration.

You may also receive a `WWW-Authenticate` header with `resource_metadata="…"` on `401` responses once protected APIs exist.

## 2. Supported flows (reserved — not active)

When enabled, this service may support:

| Method | When to use |
| --- | --- |
| `identity_assertion` + ID-JAG | Agent has a verified identity assertion for this audience |
| `identity_assertion` + verified email | User email required; OTP claim before credentials |
| `anonymous` | No identity yet; optional OTP claim to bind a user |

Cross-check your choice against `agent_auth` in the authorization-server document before sending any request.

## 3. Registration endpoints (reserved)

| Endpoint | Purpose |
| --- | --- |
| `POST https://www.brycekirk.com/agent/auth` | Register (`register_uri`) |
| `POST https://www.brycekirk.com/agent/auth/claim` | Start OTP claim (`claim_uri`) |
| `POST https://www.brycekirk.com/agent/auth/revoke` | Revoke credentials (`revocation_uri`) |

**Status:** These paths are advertised for discovery only. Do not expect `200` responses with credentials until this stub is replaced by a real implementation.

## 4. Live contact (not OAuth)

Unauthenticated inquiries:

`POST https://www.brycekirk.com/api/contact`

JSON body: `name`, `email`, `message`; optional `company`, `project_url`. Honeypot field `_gotcha` must be omitted or empty. Rate-limited. GET the same URL for the schema.

This is not agent registration and does not return credentials.

## 5. Human contact

For integration questions about agent access to this site, use the contact form at https://www.brycekirk.com/contact or the channels listed in the site footer.