# Auth.md

Spoky Ai publishes agent-discovery metadata for future protected APIs.

## Discovery

- OpenID Connect: /.well-known/openid-configuration
- OAuth 2.0 Authorization Server: /.well-known/oauth-authorization-server
- OAuth Protected Resource Metadata: /.well-known/oauth-protected-resource
- Web Bot Auth JWKS: /.well-known/http-message-signatures-directory
- OAuth registration: /oauth/register
- OAuth revocation: /oauth/revoke

## OAuth Protected Resource Metadata

The public API namespace is described by the protected resource document at:

-   /.well-known/oauth-protected-resource

## Agent registration

- Register URI: /oauth/register
- Supported identity types: public
- Credential types: none
- Claim URL: /auth.md
- Revocation URL: /oauth/revoke

## Current state

The public site is still a marketing and discovery surface.
Protected API flows are not active yet, so the OAuth endpoints are published as discovery metadata only.

## Notes

- API catalog: /.well-known/api-catalog
- API docs: /api/docs
- API status: /api/health