# job-55i.pages.dev auth.md

> Machine and developer instructions for AI Agent registration, authentication, and scoped access to job-55i.pages.dev.

## Overview
This service implements the open **Auth.md** protocol for autonomous AI agent discovery, self-registration, and user-scoped credential issuance.

- **Service URL**: https://job.web.id
- **Service Description**: Portal informasi dan publikasi konten digital.
- **Protected Resource Metadata**: [/.well-known/oauth-protected-resource](https://job.web.id/.well-known/oauth-protected-resource)
- **Authorization Server Metadata**: [/.well-known/oauth-authorization-server](https://job.web.id/.well-known/oauth-authorization-server)
- **MCP Server Card (SEP-1649 & SEP-2127)**: [/.well-known/mcp/server-card.json](https://job.web.id/.well-known/mcp/server-card.json)
- **Web Bot Auth Signatures Directory (IETF WebBotAuth)**: [/.well-known/http-message-signatures-directory](https://job.web.id/.well-known/http-message-signatures-directory)
- **API Catalog**: [/.well-known/api-catalog](https://job.web.id/.well-known/api-catalog)
- **Machine Documentation**: [https://job.web.id/llms.txt](https://job.web.id/llms.txt)

---

## Agent Registration Discovery

Agents can discover authorization endpoints via RFC 9728 and RFC 8414 metadata:

1. Fetch **Protected Resource Metadata (PRM)** from `/.well-known/oauth-protected-resource`.
2. Inspect the advertised `authorization_servers` and fetch `/.well-known/oauth-authorization-server`.
3. Locate the `agent_auth` block containing `register_uri`, `claim_uri`, `revocation_uri`, and supported identity/credential types.

---

## Supported Authentication & Registration Flows

### 1. Identity Assertion Flow (ID-JAG & Verified Email)
Trusted agent providers or platforms asserting identity via Identity Assertion JWT Authorization Grants (ID-JAG) or verified email:
- **Identity Types**: `identity_assertion`
- **Assertion Types**: `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
- **Credential Types**: `api_key`, `bearer_token`
- **Registration Endpoint**: `POST https://job.web.id/api/agent/register`

### 2. Anonymous & User Claimed Flow
Autonomous agents can register an ephemeral anonymous agent session, which can subsequently be linked to an authenticated user account:
- **Identity Types**: `anonymous`
- **Credential Types**: `api_key`, `bearer_token`
- **Registration Endpoint**: `POST https://job.web.id/api/agent/register`
- **Claim Endpoint**: `POST https://job.web.id/api/agent/claim`
- **Revocation Endpoint**: `POST https://job.web.id/api/agent/revoke`

---

## Registration Request (cURL Example)

```bash
curl -X POST "https://job.web.id/api/agent/register" \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "MyAiAgent/1.0",
    "identity_type": "anonymous",
    "scopes": ["posts:read", "read"]
  }'
```

### Registration Response
```json
{
  "status": "success",
  "client_id": "agent_sample_id",
  "token_type": "Bearer",
  "access_token": "agt_live_sample_token",
  "scopes": ["posts:read", "read"],
  "expires_in": 86400,
  "claim_uri": "https://job.web.id/api/agent/claim",
  "revocation_uri": "https://job.web.id/api/agent/revoke"
}
```

---

## Available Scopes

| Scope | Description |
| :--- | :--- |
| `read` | Read-only access to public articles, categories, tags, and site configs |
| `posts:read` | Read published articles and feed content |
| `posts:write` | Author draft posts (requires claimed admin or editor privilege) |
| `write` | General write operations (requires verified assertion or claimed session) |

---

## Credential Usage & Revocation

Present credentials in API requests:
```http
GET /api/posts HTTP/1.1
Host: job-55i.pages.dev
Authorization: Bearer <access_token>
```

To revoke credentials:
```bash
curl -X POST "https://job.web.id/api/agent/revoke" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{"token": "<access_token>"}'
```