# auth.md — authentication at carterlasalle.com

## Agent audience

This document is for AI agents and automated clients that want to use the public, machine-readable
surface of `carterlasalle.com`:

- Model Context Protocol server — `POST /mcp` (`get-portfolio-profile`)
- A2A agent — `POST /a2a` (A2A 1.0 over JSON-RPC 2.0)
- HTTP API — `/api/status`, plus the same-origin contact endpoint (`/openapi.json`, `/docs/api`)

## Registration

Registration is neither required nor offered. The only identity type this service accepts is
`anonymous`: no account, provisioning step, client identifier, or credential is created or issued.
Agents that want a machine-readable statement of that posture read the `agent_auth` block in
`/.well-known/oauth-authorization-server`, whose `register_uri` and `claim_uri` point back at this
document.

## Supported methods

- **Anonymous access.** Every public endpoint is unauthenticated; send no credentials. This is the
  only supported method and the only entry in `agent_auth.identity_types_supported`.
- **Same-origin contact.** `POST /api/contact` is restricted to browser requests originating from
  this site and is rate limited; it never issues credentials.

## Credential use

There are no credentials to obtain, present, refresh, revoke, or claim, so `agent_auth.anonymous`
declares an empty `credential_types_supported` list. Requests carrying an `Authorization` header are
neither required nor evaluated.

## Discovery documents

- `/.well-known/oauth-protected-resource` — names this origin as its only authorization server and
  advertises `bearer_methods_supported: ["header"]`; no bearer tokens are accepted.
- `/.well-known/oauth-authorization-server` — declares zero supported grants, response types, and
  scopes, no authorization, token, or revocation endpoints, and an `agent_auth` block whose only
  registration method is anonymous.
- `/.well-known/api-catalog`, `/openapi.json`, `/docs/api` — the HTTP API surface.
- `/.well-known/agent-card.json` and `/.well-known/mcp/server-card.json` — agent and MCP servers.
- `/.well-known/ai-catalog.json` — the Agentic Resource Discovery manifest.

If protected APIs are introduced later, this document will link to their authorization-server and
protected-resource metadata, and the registration and credential sections above will be replaced
with the applicable flows.