# auth.md

You are an agent. Oh My Sod does **not** support **agentic registration**. There is no OAuth 2.0 / OpenID Connect authorization server, no Protected Resource Metadata for bearer auth on public APIs, and no `agent_auth` registration surface.

Public site features and public HTTP APIs are intentionally open (subject to rate limits, Turnstile on some POSTs, and Cloudflare bot protections). **Do not register.** Call the discovery URLs and JSON APIs below.

## Audience

AI agents and integrators helping homeowners with sod installation, sod delivery, stump grinding, and nursery/tree browsing in the Raleigh–Durham, NC area.

Resource host (API + site): `https://ohmysod.pro`  
Authorization server: **none** (not applicable)

## Discover

1. Prefer homepage `Link` response headers (RFC 8288) and `/.well-known/api-catalog` (RFC 9727).
2. There is **no** `WWW-Authenticate: Bearer resource_metadata="…"` on public APIs — they do not require a bearer token.
3. `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server` are **not published**. Do not expect `issuer`, `token_endpoint`, `jwks_uri`, `register_uri`, `identity_endpoint`, `claim_endpoint`, or an `agent_auth` block on this origin.

Machine-readable discovery that **does** exist:

| Resource | URL |
|----------|-----|
| API catalog | `https://ohmysod.pro/.well-known/api-catalog` |
| OpenAPI | `https://ohmysod.pro/openapi.json` |
| Human API docs | `https://ohmysod.pro/docs/api` |
| Health | `https://ohmysod.pro/api/health` |
| Agent Skills | `https://ohmysod.pro/.well-known/agent-skills/index.json` |
| MCP server card | `https://ohmysod.pro/.well-known/mcp/server-card.json` |

## Pick a method

No registration methods are supported (`identity_assertion`, `service_auth`, and `anonymous` are all **disabled**). Skip registration and use public access.

## Register

**Agent registration is not available.** There is no `register_uri`, no `POST /agent/identity`, no `POST /agent/auth`, and no client-credentials or dynamic client registration for agents.

Do **not** invent tokens. Proceed with unauthenticated GETs/POSTs as documented in `/openapi.json`.

## Public access (no registration)

These endpoints are intentionally public:

- Discovery: `/.well-known/api-catalog`, `/openapi.json`, `/docs/api`, `/api/health`
- Catalog reads: `/api/nursery-inventory`, `/api/big-box-sod-prices`, `/api/maps-public-config`
- Lead POSTs: `/api/contact`, `/api/sod-order`, `/api/tree-order`, `/api/install-estimate`, `/api/stump-estimate`, `/api/hub-question`

Prefer HTML forms on `/estimate-request`, `/sod-order`, `/order-trees`, and `/stump-estimate` for humans. Agents may call the JSON APIs described in `/openapi.json`.

## Claim ceremony

Not applicable — no claim_endpoint, no `user_code` / `verification_uri` flow.

## Exchange the assertion / Use the access_token

Not applicable — no `token_endpoint` and no access tokens for public APIs.

## Operator admin (not for agents)

`/api/admin/*` uses a shared `Authorization: Bearer` token for site operators only. There is **no** public agent registration, client credentials grant, or OAuth authorization server that issues those tokens.

## Preferred agent discovery

1. Homepage `Link` headers (RFC 8288)
2. `/.well-known/api-catalog` (RFC 9727)
3. `/.well-known/agent-skills/index.json`
4. In-browser WebMCP tools on HTML pages
5. `/.well-known/mcp/server-card.json`

When the primary domain moves fully to `ohmysod.com`, the same paths will apply on that host.