# Auth.md

Authentication and agent registration guide for Dicas dos Papais.
Machine-readable auth manifest for AI agents (Auth.md spec, see https://workos.com/auth-md).

- Site: https://dicasdospapais.com.br
- Contact: ricardo@dicasdospapais.com.br
- Protected resource metadata: https://dicasdospapais.com.br/.well-known/oauth-protected-resource
- Authorization server metadata: https://dicasdospapais.com.br/.well-known/oauth-authorization-server
- OpenID Connect discovery: https://dicasdospapais.com.br/.well-known/openid-configuration
- Skills index: https://dicasdospapais.com.br/.well-known/agent-skills/index.json

## Resources

| Resource | URL | Auth |
| --- | --- | --- |
| MCP server (read-only blog tools) | `https://cyqvdmhvkogyoagkvded.supabase.co/functions/v1/mcp` | none (public) |
| Blog Agent API (create/update posts) | `https://cyqvdmhvkogyoagkvded.supabase.co/functions/v1/blog-agent` | API key |
| Public blog content | `https://dicasdospapais.com.br/blog` | none |

## 1. Public access (no registration)

The MCP server and all published blog content are open. Connect an MCP client to
the endpoint above (Streamable HTTP, JSON-RPC 2.0) and call `list_blog_posts`,
`get_blog_post`, or `list_categories`. No credentials, no registration.

## 2. OAuth 2.1 / OIDC (delegated user access)

- Issuer: `https://cyqvdmhvkogyoagkvded.supabase.co/auth/v1`
- Authorization endpoint: `{issuer}/oauth/authorize`
- Token endpoint: `{issuer}/oauth/token`
- JWKS: `{issuer}/.well-known/jwks.json`
- Dynamic client registration (RFC 7591): `{issuer}/oauth/clients/register`
- Grant types: `authorization_code` (PKCE `S256` required), `refresh_token`
- Scopes: `openid`, `profile`, `email`
- Token type: JWT bearer, sent as `Authorization: Bearer <token>`

Agents may self-register a client at the registration endpoint, then run the
standard authorization-code + PKCE flow. A human user must approve the consent
screen; tokens act on behalf of that user and remain subject to the app's
row-level security policies.

## 3. API key (server-to-server writes)

The Blog Agent API uses a static key in the `x-api-key` header. Keys are issued
manually — email ricardo@dicasdospapais.com.br with the agent name and intended
use. Keys are revocable at any time; rotation invalidates the previous value.

```http
POST /functions/v1/blog-agent HTTP/1.1
Host: cyqvdmhvkogyoagkvded.supabase.co
Content-Type: application/json
x-api-key: <BLOG_AGENT_API_KEY>

{"action":"list"}
```

Full reference: https://dicasdospapais.com.br/docs/blog-agent-api.md

## 4. Agent Auth metadata

Agents can discover registration metadata from:

- `https://dicasdospapais.com.br/.well-known/oauth-authorization-server`
- `https://dicasdospapais.com.br/.well-known/oauth-protected-resource`

The `agent_auth` block declares:

- `skill`: `https://isitagentready.com/.well-known/agent-skills/auth-md/SKILL.md`
- `register_uri`: OAuth dynamic client registration for delegated user access
- `identity_types_supported`: `delegated_user`, `service_account`, `anonymous`
- `credential_types_supported`: `oauth2_access_token`, `api_key`, `none`
- `registration_methods`: OAuth dynamic client registration, manual API key request, and public anonymous access

## Errors

| Status | Meaning |
| --- | --- |
| 401 | Missing or invalid credential. Re-authenticate or request a new key. |
| 403 | Authenticated but not permitted for this resource. |
| 429 | Rate limited. Back off and retry. |

## Policies

- Content usage preferences: https://dicasdospapais.com.br/robots.txt (`Content-Signal`)
- Privacy: https://dicasdospapais.com.br/politica-de-privacidade
- Do not use credentials to publish content that violates the editorial rules in
  the `blog-agent` skill.