# auth.md

You are an agent. Petite Tap publishes a read-only company profile. You do not create an account, and you do not receive an access token or an API key.

## Audience

Agents reading the public profile. There is no user to register on behalf of.

## Registration

The only identity type is `anonymous`. The only credential type is `none`: no credential is issued.

1. Read the protected resource metadata: [https://www.petitetap.com/.well-known/oauth-protected-resource](https://www.petitetap.com/.well-known/oauth-protected-resource)
2. Read the authorization server metadata: [https://www.petitetap.com/.well-known/oauth-authorization-server](https://www.petitetap.com/.well-known/oauth-authorization-server)
3. Read the registration document, which is `register_uri` and `identity_endpoint`: [https://www.petitetap.com/api/agent-registration.json](https://www.petitetap.com/api/agent-registration.json)
4. Read the claim document, which is `claim_uri`, `claim_endpoint` and `anonymous.claim_uri`: [https://www.petitetap.com/api/agent-claim.json](https://www.petitetap.com/api/agent-claim.json)

The protected resource metadata names this origin as its authorization server. `scopes_supported` is `profile.read`. `bearer_methods_supported` is `header`. No access token is issued, and none is checked. Call the API with no `Authorization` header.

The language homepages are resources too. Insert the well-known suffix before the homepage path: [https://www.petitetap.com/.well-known/oauth-protected-resource/cz/](https://www.petitetap.com/.well-known/oauth-protected-resource/cz/) and [https://www.petitetap.com/.well-known/oauth-protected-resource/en/](https://www.petitetap.com/.well-known/oauth-protected-resource/en/). In those documents `resource` is the homepage URL. `authorization_servers` and `scopes_supported` match the origin document. Each homepage also sends `WWW-Authenticate` with `resource_metadata` set to that URL.

A GET of the registration document is the whole registration. It returns JSON with `registration_type` `anonymous` and `credential_type` `none`. That JSON is not an access token. Do not exchange it.

A GET of the claim document is the whole claim. It returns JSON with the same `registration_type`, `credential_type` and `scope`. It does not bind a user. There is no user code and no verification URI. Do not POST a claim.

There is no revocation URL. Nothing is issued, so nothing can be revoked. Do not look for a token endpoint.

## Calling the API

`profile.read` is already available. Send GET, with no `Authorization` header.

- Company profile: [https://www.petitetap.com/api/company.json](https://www.petitetap.com/api/company.json)
- Health: [https://www.petitetap.com/api/health.json](https://www.petitetap.com/api/health.json)
- OpenAPI: [https://www.petitetap.com/api/openapi.json](https://www.petitetap.com/api/openapi.json)
- Human documentation: [https://www.petitetap.com/api/](https://www.petitetap.com/api/)
- API catalog: [https://www.petitetap.com/.well-known/api-catalog](https://www.petitetap.com/.well-known/api-catalog)
- MCP server card: [https://www.petitetap.com/.well-known/mcp/server-card.json](https://www.petitetap.com/.well-known/mcp/server-card.json)
- Agent skills: [https://www.petitetap.com/.well-known/agent-skills/index.json](https://www.petitetap.com/.well-known/agent-skills/index.json)
- Capability catalog: [https://www.petitetap.com/.well-known/ai-catalog.json](https://www.petitetap.com/.well-known/ai-catalog.json)

The profile leaves out the email address and the bank accounts.