# Auth.md

This document describes how AI agents can authenticate with
Ichthus Cranes' website and any protected APIs.

## Overview

The public marketing site does not require authentication. All
pages listed in `/llms.txt` and `/sitemap.xml` are readable
by unauthenticated agents.

When protected APIs become available, agents should discover them
through the OAuth 2.0 metadata endpoints below.

## Discovery Endpoints

- Protected resource metadata: [/.well-known/oauth-protected-resource](https://ichthuscranes.com/.well-known/oauth-protected-resource)
- Authorization server metadata: [/.well-known/oauth-authorization-server](https://ichthuscranes.com/.well-known/oauth-authorization-server)
- OpenID configuration: [/.well-known/openid-configuration](https://ichthuscranes.com/.well-known/openid-configuration)
- API catalog: [/.well-known/api-catalog](https://ichthuscranes.com/.well-known/api-catalog)
- MCP server card: [/.well-known/mcp/server-card.json](https://ichthuscranes.com/.well-known/mcp/server-card.json)
- Agent skills: [/.well-known/agent-skills/index.json](https://ichthuscranes.com/.well-known/agent-skills/index.json)

## Agent Registration

Dynamic client registration is not currently offered. To request
an agent client credential, contact:

- Email: info@ichthuscranes.com
- Contact page: https://ichthuscranes.com/contact.html

## Supported Identity Types

- `human` — a natural person acting through the agent
- `service` — a machine-to-machine service account

## Supported Credential Types

- OAuth 2.0 authorization code with PKCE
- OAuth 2.0 client credentials (for `service` identities)

## Token & Claim Handling

- Access tokens are JWTs issued by the authorization server above.
- Required claims: `iss`, `sub`, `aud`, `exp`, `iat`.
- Revocation endpoint: see `revocation_endpoint` in the
  authorization server metadata.

## Contact

For agent onboarding or security questions, use the contact page
above.