# auth.md

This service supports agentic registration. Agents acting for users may register at Care From China.

Resource server: https://carefromchina.com/
Authorization server: https://carefromchina.com/

## Agent Registration
register_uri: https://carefromchina.com
supported_identity_types: ["none", "email"]
credential_types: ["bearer_token"]
claim_uri: https://carefromchina.com
revocation_uri: https://carefromchina.com/oauth2/revoke

## Discover

1. On 401, read WWW-Authenticate: Bearer resource_metadata="https://carefromchina.com/.well-known/oauth-protected-resource"
   or fetch /.well-known/oauth-protected-resource directly.
2. Fetch Protected Resource Metadata and read resource, authorization_servers, scopes_supported, bearer_methods_supported.
3. Fetch Authorization Server Metadata at /.well-known/oauth-authorization-server and read the agent_auth block.

## Pick a method

- Have ID-JAG? → identity_assertion + id-jag
- Have user email? → identity_assertion + verified_email
- Have neither? → anonymous

## Register

### identity_assertion + verified_email
```http
POST /agent/identity HTTP/1.1
Host: carefromchina.com
Content-Type: application/json

{"type":"identity_assertion","assertion_type":"verified_email","assertion":"user@example.com"}
```

### anonymous
```http
POST /agent/identity HTTP/1.1
Host: carefromchina.com
Content-Type: application/json

{"type":"anonymous"}
```

## Claim ceremony
4a. Trigger, 4b. Wait for OTP, 4c. Submit OTP

## Use the credential
Authorization: Bearer <credential>

## Errors

| code | action |
| invalid_claim_token | restart Register |
| otp_invalid | retry |

## Revocation
Agents detect via 401.