# Auth.md

```json
{
  "agent_auth": {
    "register_uri": "https://citeflow.co.uk/signup",
    "instructions_uri": "https://citeflow.co.uk/auth.md",
    "supported_identity_types": ["human", "agent"],
    "supported_credential_types": ["oauth2_access_token", "bearer_api_key"],
    "claim_uri": "https://citeflow.co.uk/dashboard/settings",
    "revocation_uri": "https://citeflow.co.uk/dashboard/settings",
    "authorization_server": "https://citeflow.co.uk/.well-known/oauth-authorization-server",
    "protected_resource": "https://citeflow.co.uk/.well-known/oauth-protected-resource",
    "scopes_supported": ["openid", "email", "profile", "offline_access"]
  }
}
```

## CiteFlow — Agent Authentication

CiteFlow's customer APIs are protected by OAuth 2.0 / OpenID Connect.
Agents should follow the discovery documents below before attempting to
call any endpoint under `https://citeflow.co.uk/api/`.

## Discovery

- OpenID Connect: `/.well-known/openid-configuration`
- OAuth 2.0 Authorization Server: `/.well-known/oauth-authorization-server`
- OAuth 2.0 Protected Resource (RFC 9728): `/.well-known/oauth-protected-resource`
- API Catalog (RFC 9727): `/.well-known/api-catalog`
- MCP Server Card: `/.well-known/mcp/server-card.json`
- Skill Index: `/.well-known/agent-skills/index.json`

## Registration

Agents act on behalf of a CiteFlow customer. The customer must:

1. Sign up at <https://citeflow.co.uk/signup>.
2. Confirm their email and complete onboarding.
3. Grant the agent access from **Dashboard → Settings**.

Self-service programmatic agent registration is not yet enabled.
Until it is, agents authenticate using a user-scoped OAuth flow against
the issuer advertised in `/.well-known/openid-configuration`.

## Supported credential types

- OAuth 2.0 access tokens (Bearer in `Authorization` header)
- API keys for webhook callers (per integration; see the relevant docs page)

## Scopes

`openid`, `email`, `profile`, `offline_access`.

## Revocation

Tokens and API keys can be revoked at any time from
<https://citeflow.co.uk/dashboard/settings>.

## Contact

Security or auth questions: <https://citeflow.co.uk/contact>.