# auth.md

You are an agent. This origin is a **public professional portfolio**. Discovery, profile data, projects, and the contact API do not require an access token. Follow the steps below; do not invent credentials.

## Step 1 — Discover

### 1a. Fetch the Protected Resource Metadata

```http
GET https://sebastianalcaraz.com/.well-known/oauth-protected-resource
```

### 1b. Fetch the Authorization Server metadata

```http
GET https://sebastianalcaraz.com/.well-known/oauth-authorization-server
```

Read `agent_auth.skill` (this file), `agent_auth.register_uri`, and `identity_types_supported`. The only supported identity type is `anonymous`.

## Step 2 — Register (optional)

```http
POST https://sebastianalcaraz.com/oauth/register
Content-Type: application/json

{ "identity_type": "anonymous" }
```

The response confirms public access. **Do not send an Authorization header** to `/api/contact`, `/api/health`, `/mcp`, or discovery documents.

## Step 3 — Call the API

Contact:

```http
POST https://sebastianalcaraz.com/api/contact
Content-Type: application/json

{
  "name": "Ada Lovelace",
  "email": "ada@example.com",
  "message": "We would like to discuss a PrestaShop integration."
}
```

Limits: name ≤ 100 chars, email ≤ 254, message ≤ 2000. Rate limit: 5 requests / minute / IP. Include a real reply-to email.

MCP tools are advertised at `/.well-known/mcp/server-card.json`.

## Claim and revocation

There are no issued agent credentials on this origin, so there is nothing to claim or revoke. `POST /oauth/claim` and `POST /oauth/revoke` return that status.