# auth.md — trusteed.xyz agent authentication

This site is agent-ready. Agents authenticate via OAuth 2.1 against an Auth0
authorization server.

Dynamic client registration (RFC 7591) is open: POST to the `registration_endpoint` published in the authorization server metadata and you get a client back, no credential needed. Registered clients are third-party applications — a user consent screen is always shown and cannot be skipped. Client credentials for server-to-server use are still issued by agreement: write to developers@trusteed.xyz.

## Discovery

- Protected Resource Metadata (RFC 9728), per resource:
  `https://trusteed.xyz/.well-known/oauth-protected-resource/{storeSlug}/mcp`
  (names the authorization server in `authorization_servers`)
- Authorization Server Metadata (RFC 8414), published by the issuer, not by this host:
  `https://auth.trusteed.xyz/.well-known/oauth-authorization-server`
- JWKS: `https://auth.trusteed.xyz/.well-known/jwks.json`
- The public demo store (`demo-store`) needs no authorization server: it uses a
  self-service sandbox key from `https://api.trusteed.xyz/api/v1/sandbox/key`.

## Identity types supported

- `oauth2-client-credentials`
- `oauth2-authorization-code`

## Credential types supported

- `client_secret`
- `private_key_jwt`

## How to register

Automated clients: POST your client metadata to `https://auth.trusteed.xyz/oidc/register`
(RFC 7591). No credential is required to register, and the resulting client is a
third-party application: every authorization shows the user a consent screen.

For credentials tied to a merchant account, follow the human path:

1. Sign up at `https://trusteed.xyz/register`.
2. Request agent/API credentials from the dashboard.
3. Request a token from `https://auth.trusteed.xyz/oauth/token`, scoped per
   `scopes_supported` in the authorization-server metadata above.
4. Call MCP endpoints (`/:storeSlug/mcp/*`) with `Authorization: Bearer <token>`.

## Revocation

- `https://auth.trusteed.xyz/oauth/revoke`