# auth.md

> Agent registration and authentication metadata for https://www.techpods.co.

## Audience

This document is for AI agents that want to authenticate with TechPods'
protected API — currently a single action: submitting a contact enquiry on a
user's behalf (the agent equivalent of the website contact form).

Public content (company info, blog posts, careers, sectors, MCP server, llms.txt)
requires **no** authentication. Only `/agent/protected/*` requires a token.

## Identity types

| Type | Credential | Notes |
|------|-----------|-------|
| `anonymous` | none | No client registration or secret required. |

## Registration

Anonymous agents need no credentials and nothing to provision. You may call the
registration endpoint to discover the flow, but it is optional:

```
POST https://www.techpods.co/agent/identity
Content-Type: application/json

{ "identity_type": "anonymous" }
```

There is no claim ceremony for anonymous identities; https://www.techpods.co/agent/identity/claim reports
`claim_required: false`.

## Obtain a token

Request an access token with the OAuth 2.0 `client_credentials` grant
(RFC 6749 §4.4). No client authentication is required:

```
POST https://www.techpods.co/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
```

Response:

```json
{ "access_token": "<JWT>", "token_type": "Bearer", "expires_in": 3600, "scope": "agent:enquiry" }
```

The token is an RS256 JWT; verify it against the JWKS listed in the
[authorization server metadata](/.well-known/oauth-authorization-server).

## Use the token

Present the token as a Bearer credential on the protected resource
(see [protected resource metadata](https://www.techpods.co/.well-known/oauth-protected-resource)):

```
POST https://www.techpods.co/agent/protected/enquiry
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "fullName": "Jane Buyer",
  "email": "jane@example.com",
  "company": "Example Ltd",
  "message": "We'd like to discuss a co-sourcing engagement."
}
```

A successful call delivers the enquiry to TechPods. The endpoint is rate limited
and sends only to TechPods (it is not an open relay).

## Discovery

- Authorization server metadata: /.well-known/oauth-authorization-server (includes the `agent_auth` block)
- Protected resource metadata: /.well-known/oauth-protected-resource
- JWKS: /.well-known/jwks.json