# auth.md — trusteed.xyz agent authentication

This site is agent-ready. Agents authenticate via OAuth 2.1 against an Auth0
authorization server. There is no self-serve dynamic client registration
(RFC 7591) yet — credentials are issued through merchant/developer signup.

## Discovery

- Protected Resource Metadata (RFC 9728): `/.well-known/oauth-protected-resource`
- Authorization Server Metadata (RFC 8414): `/.well-known/oauth-authorization-server`
- JWKS: `https://auth.trusteed.xyz/.well-known/jwks.json`

## Identity types supported

- `oauth2-client-credentials` — machine-to-machine agents (server-side)
- `oauth2-authorization-code` (+ PKCE) — agents acting on behalf of a signed-in user

## Credential types supported

- `client_secret` (Basic or POST body)
- `private_key_jwt`

## How to register

1. Sign up at `https://trusteed.xyz/register`.
2. Request agent/API credentials from the dashboard.
3. Request a token from `https://auth.trusteed.xyz/oauth/token`, scoped per
   `scopes_supported` in the authorization-server metadata above.
4. Call MCP endpoints (`/:storeSlug/mcp/*`) with `Authorization: Bearer <token>`.

## Revocation

- `https://auth.trusteed.xyz/oauth/revoke`