# auth.md — AKADATA Agent Registration

AKADATA provides a small cookie-free OAuth service for agents and automated clients. Public site and MCP reading remains available without authentication.

## Audience

This document is for AI agents and automated tools that need an AKADATA-issued credential for protected interfaces.

## Registration

Send JSON to `POST https://www.akadata.ltd/agent/auth/register`:

```json
{"client_name":"My agent"}
```

The response contains a `client_id` and one-time `client_secret`. Store the secret securely; AKADATA stores only its Argon2id hash.

## Obtain a bearer token

Use HTTP Basic client authentication with `POST https://www.akadata.ltd/oauth/token` and `grant_type=client_credentials`. Tokens are ES256-signed and expire after 15 minutes.

## Claims and revocation

- Claim details: `https://www.akadata.ltd/agent/auth/claim`
- Revoke the client credential: `POST https://www.akadata.ltd/agent/auth/revoke`
- Revoke one access token: `POST https://www.akadata.ltd/oauth/revoke`
- Inspect one access token: `POST https://www.akadata.ltd/oauth/introspect`

## Protected resource

Send `Authorization: Bearer <access_token>` to `https://www.akadata.ltd/oauth/resource`.

## Discovery

- [https://www.akadata.ltd/.well-known/oauth-authorization-server](https://www.akadata.ltd/.well-known/oauth-authorization-server)
- [https://www.akadata.ltd/.well-known/openid-configuration](https://www.akadata.ltd/.well-known/openid-configuration)
- [https://www.akadata.ltd/.well-known/oauth-protected-resource](https://www.akadata.ltd/.well-known/oauth-protected-resource)
- [https://www.akadata.ltd/oauth/jwks.json](https://www.akadata.ltd/oauth/jwks.json)

## Current identity model

Registration is anonymous and represents an automated client, not a verified human identity. Do not treat these credentials as proof of a person, company, or email address.