# auth.md - Sakurakun999 Agent Authentication & Registration

This document defines the authentication, discovery, and registration protocols for autonomous AI agents accessing the Sakurakun999 portfolio and API services.

## Overview

The Sakurakun999 portfolio and API endpoints are designed to be accessible both anonymously and with authenticated agent credentials per the [Auth.md](https://auth.md/) standard.

- **Audience**: Autonomous AI Agents, Machine Clients, Crawlers
- **Resource Server**: `https://skrk999.com`
- **Authorization Server**: `https://skrk999.com`
- **Protocols**: RFC 8414 (OAuth Authorization Server Metadata), RFC 9728 (OAuth Protected Resource Metadata), Auth.md

## Discovery Endpoints

- **Protected Resource Metadata**: [/.well-known/oauth-protected-resource](https://skrk999.com/.well-known/oauth-protected-resource)
- **Authorization Server Metadata**: [/.well-known/oauth-authorization-server](https://skrk999.com/.well-known/oauth-authorization-server)
- **API Catalog**: [/.well-known/api-catalog](https://skrk999.com/.well-known/api-catalog)
- **OpenAPI Specification**: [/openapi.json](https://skrk999.com/openapi.json)

## Supported Registration & Authentication Methods

### 1. Anonymous Access
- **Identity Type**: `anonymous`
- **Scopes Supported**: `read`, `profile`, `projects`
- **Credential Types**: `bearer_token`, `api_key`
- **Claim URI**: `https://skrk999.com/agent/claim`
- **Usage**: Public portfolio content, works archive, and open data endpoints can be accessed without credentials or with temporary client credentials.

### 2. Identity Assertion (ID-JAG)
- **Identity Type**: `identity_assertion`
- **Assertion Type**: `urn:ietf:params:oauth:token-type:id-jag`
- **Credential Types**: `bearer_token`, `api_key`
- **Register URI**: `https://skrk999.com/agent/auth`
- **Revocation URI**: `https://skrk999.com/agent/revoke`

### 3. Verified Email
- **Identity Type**: `identity_assertion`
- **Assertion Type**: `verified_email`
- **Credential Types**: `bearer_token`, `api_key`
- **Claim URI**: `https://skrk999.com/agent/claim`

## Agent Registration & Provisioning Flow

### 1. Anonymous Provisioning (Claim Endpoint)
- **Method**: `POST`
- **Endpoint**: `https://skrk999.com/agent/claim`
- **Request Body**:
```json
{
  "grant_type": "client_credentials",
  "client_name": "AutonomousAgent/1.0"
}
```
- **Response**:
```json
{
  "access_token": "skrk_anon_token_example",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "read profile projects"
}
```

### 2. ID-JAG Identity Assertion Registration
- **Method**: `POST`
- **Endpoint**: `https://skrk999.com/agent/auth`
- **Request Body**:
```json
{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token_type": "urn:ietf:params:oauth:token-type:id-jag",
  "subject_token": "<signed-id-jag-jwt>"
}
```
- **Response**:
```json
{
  "access_token": "skrk_agent_token_example",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read profile projects"
}
```

## Credential Usage

When calling protected endpoints, provide the Bearer token in the `Authorization` header:

```http
GET /api/projects HTTP/1.1
Host: skrk999.com
Authorization: Bearer <your-token>
```