# auth.md

You are an agent. This service supports **agentic registration**: discover → register → exchange for an access_token → call API → handle revocation. Follow the steps in order; do not skip ahead.

This personal blog uses a simplified, standalone anonymous registration flow for agents since all blog content is public and read-only.

## Step 1 — Discover

You can discover the metadata resources for enochblogs.space:

1. **OAuth Protected Resource Metadata** (RFC 9728):
```http
GET https://enochblogs.space/.well-known/oauth-protected-resource
```

Response:
```json
{
  "resource": "https://enochblogs.space",
  "authorization_servers": ["https://api.enochblogs.space"],
  "scopes_supported": ["read"],
  "bearer_methods_supported": ["header"]
}
```

2. **OAuth Authorization Server Metadata** (RFC 8414):
```http
GET https://api.enochblogs.space/.well-known/oauth-authorization-server
```

Response:
```json
{
  "issuer": "https://api.enochblogs.space",
  "token_endpoint": "https://api.enochblogs.space/api/auth/token",
  "registration_endpoint": "https://api.enochblogs.space/api/auth/register-agent",
  "jwks_uri": "https://api.enochblogs.space/.well-known/jwks.json",
  "response_types_supported": ["token"],
  "grant_types_supported": ["client_credentials"],
  "token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
  "scopes_supported": ["read"],
  "agent_auth": {
    "skill": "https://enochblogs.space/auth.md",
    "register_uri": "https://api.enochblogs.space/api/auth/register-agent",
    "revocation_uri": "https://api.enochblogs.space/api/auth/revoke-agent",
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["none", "api-key"],
      "claim_uri": "https://api.enochblogs.space/api/auth/register-agent"
    }
  }
}
```

## Step 2 — Pick a method

This service supports the **anonymous** agent registration method. No user login or identity assertion (ID-JAG) is required to access the public read-only content of this blog.

## Step 3 — Register

Request an anonymous agent token by sending a POST request to the registration endpoint:

```http
POST https://api.enochblogs.space/api/auth/register-agent
Content-Type: application/json

{
  "type": "anonymous",
  "agentName": "YourAgentName",
  "email": "agent@yourdomain.com"
}
```

Response (201 Created):
```json
{
  "success": true,
  "token": "eb_agent_...",
  "expiresAt": "..."
}
```

## Step 4 — Claim Ceremony

Since this is a read-only blog with anonymous access, the claim ceremony is optional/none. The token returned in Step 3 is immediately ready for use.

## Step 5 — Exchange the assertion

The registration token returned in Step 3 acts directly as your access token. You do not need to perform an additional token exchange step.

## Step 6 — Use the access_token

Present the token in the `Authorization` header as a Bearer token:

```http
GET https://api.enochblogs.space/api/posts
Authorization: Bearer eb_agent_<token>
```

## Scopes

| Scope | Description |
|-------|-------------|
| `read` | Read access to posts, tags, settings, and portfolio |

## Revocation

To revoke a token, send a POST request to the revocation endpoint:

```http
POST https://api.enochblogs.space/api/auth/revoke-agent
Content-Type: application/json

{
  "token": "eb_agent_..."
}
```

Response:
```json
{
  "success": true,
  "message": "Agent token successfully revoked."
}
```