---
agent_auth:
  skill: https://isitagentready.com/.well-known/agent-skills/auth-md/SKILL.md
  register_uri: https://brandme-api.brandme266.workers.dev/register
  identity_types:
    - oauth_client
  credential_types:
    - client_credentials
    - authorization_code
  revocation_uri: https://brandme-api.brandme266.workers.dev/revoke
---

# auth.md

You are an agent. This service supports agentic registration and OAuth 2.0 authentication.

This file tells AI agents how to discover authentication endpoints, register credentials, and access protected resources on brand1me.com.

## Authentication Overview

This service uses OAuth 2.0 / OpenID Connect for agent authentication. The authorization server metadata is published at /.well-known/oauth-authorization-server and the protected resource metadata is at /.well-known/oauth-protected-resource.

## Agent Registration

Agents can register as OAuth clients to obtain credentials for accessing the API.

1. Fetch the authorization server metadata from /.well-known/oauth-authorization-server
2. Use the register_uri in the agent_auth block to register a new client
3. Use the token_endpoint with the client_credentials grant to obtain an access token
4. Include the access token as a Bearer token in the Authorization header for API requests

## agent_auth

```json
{
  "agent_auth": {
    "skill": "https://isitagentready.com/.well-known/agent-skills/auth-md/SKILL.md",
    "register_uri": "https://brandme-api.brandme266.workers.dev/register",
    "authorization_server": "https://brand1me.com/.well-known/oauth-authorization-server",
    "identity_types": ["oauth_client"],
    "credential_types": ["client_credentials", "authorization_code"],
    "grant_types": ["authorization_code", "client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"],
    "claims": ["sub", "email", "scope"],
    "revocation_uri": "https://brandme-api.brandme266.workers.dev/revoke",
    "introspection_uri": "https://brandme-api.brandme266.workers.dev/introspect"
  }
}
```

## Protected Resources

Protected API resources require a valid OAuth 2.0 Bearer token. Send the token in the Authorization header: Authorization: Bearer <access_token>

## API Catalog

The full API catalog is available at /.well-known/api-catalog.