# Auth.md - Curador Digital™ Agent Authentication & Authorization Policy

- Access Level: Public Context Reading & Authenticated Agent Operations
- Primary Protocol: /llms.txt
- Registration Endpoint: https://curadordigital.com/oauth/register
- Authorization Endpoint: https://curadordigital.com/oauth/authorize
- Token Endpoint: https://curadordigital.com/oauth/token
- Contact: contacto@curadordigital.com

This file is the agent registration recipe for https://curadordigital.com: **discover → register → claim → exchange → use → revoke**. Public context needs no registration; the steps below apply to agents that need credentials (`write`, `agents`).

## 1. Discover

- Protected resource metadata: https://curadordigital.com/.well-known/oauth-protected-resource
- Authorization server metadata (contains the `agent_auth` block): https://curadordigital.com/.well-known/oauth-authorization-server
- `agent_auth.skill` points to the skills index: https://curadordigital.com/.well-known/agent-skills/index.json
- `agent_auth.register_uri`: https://curadordigital.com/oauth/register
- `agent_auth.claim_url` and `agent_auth.revocation_url`: https://curadordigital.com/auth.md (this document)
- Scopes: `read` (public catalog, no token), `write` (submit an infrastructure audit request), `agents` (agent-to-agent interaction)

## 2. Pick an identity method

| Identity type | Status |
|---|---|
| `service_auth` (email-based) | **Supported.** The operator of the agent identifies itself by email. |
| `identity_assertion` (ID-JAG from an identity provider) | Not supported |
| `anonymous` | Not supported (public `read` needs no identity) |

Declared in metadata: `supported_identity_types`: `account`, `service`; `identity_types_supported`: `service_auth`; `supported_credential_types`: `bearer_token`.

## 3. Register

Registration is requested by the operator with `service_auth`. Send an email to contacto@curadordigital.com (the `register_uri` endpoints are reserved for automated registration and are not open yet) with:

- Agent name and the organization or person responsible (operator)
- Use case
- Scopes requested (`read`, `write`, `agents`)
- `client_name` and `redirect_uris`, if the agent uses the authorization code flow

## 4. Claim

Curador Digital™ replies to the same email address to confirm the claim: the operator confirms ownership of the agent by replying to that message. No credentials are issued before the claim is confirmed. The `claim_url` of the metadata (this document) describes this step.

## 5. Exchange

After the claim is confirmed, the operator receives a `client_id` and a `client_secret`. Request a bearer token with `POST https://curadordigital.com/oauth/token` using `grant_type=client_credentials`, the `client_id`, the `client_secret` and the requested `scope`.

## 6. Use

Send the token on every authenticated request: `Authorization: Bearer <access_token>`. Only the `header` bearer method is supported (`bearer_methods_supported`); never put tokens in the URL. Re-request a token when it expires.

## 7. Revoke

To revoke a client or a token, email contacto@curadordigital.com from the registered address indicating the `client_id`. The `revocation_url` of the metadata (this document) describes this step. Curador Digital™ may revoke credentials that are misused.

## Current status

Public context (`/llms.txt`, `/llms-full.txt`, `/.well-known/*`) is readable without authentication. Credentials are issued manually after review; there is no automatic issuance, and the `/oauth/*` endpoints are reserved until automated registration is enabled.