# auth.md

You are an agent. This service supports **anonymous agentic registration** for the public Myrenget AS company API. There is no user login and no OpenID Connect identity provider.

Discover → register (anonymous) → exchange for an access_token → call the public API. Tokens are optional: `GET /api/company` also works without Authorization.

## Audience

AI agents that need public company, contact, or division information.

## Step 1 — Discover

### 1a. Protected Resource Metadata

`GET https://www.myrenget.no/.well-known/oauth-protected-resource`

- `resource` is `https://www.myrenget.no/`
- `authorization_servers` is `["https://www.myrenget.no"]`
- `scopes_supported` includes `company:read`
- `bearer_methods_supported` is `["header"]`

### 1b. Authorization Server metadata

`GET https://www.myrenget.no/.well-known/oauth-authorization-server`

Read `issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`, `grant_types_supported`, and the `agent_auth` block (`skill`, `register_uri`, `identity_types_supported`, anonymous credential types, `claim_uri`, `revocation_uri`).

## Step 2 — Pick a method

Only **anonymous** is enabled. Do not send ID-JAG or verified-email assertions.

## Step 3 — Register

`POST https://www.myrenget.no/agent/identity`

```json
{ "type": "anonymous" }
```

The response includes `identity_assertion`. Claim/email linking is not offered.

## Step 4 — Claim ceremony

`POST https://www.myrenget.no/agent/identity/claim` returns `claim_not_supported`. Skip claim.

## Step 5 — Exchange

`POST https://www.myrenget.no/oauth2/token`

- `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with `assertion=<identity_assertion>`
- or `grant_type=client_credentials` with no client secret (`token_endpoint_auth_methods_supported` includes `none`)

## Step 6 — Call the API

Send `Authorization: Bearer <access_token>` if you have one. Public JSON still works without it:

- `GET /api/company`
- `GET /api/health`
- `GET /openapi.json`
- `GET /.well-known/api-catalog`
- `POST /mcp`

## Revocation

`POST https://www.myrenget.no/oauth2/revoke` accepts RFC 7009 revocation requests and returns 200.