# auth.md — inch.hr

Authentication and access policy for agents using inch.hr.

**inch.hr is a public website.** No authentication is required to read any page, the product catalog, the sitemap, or any discovery file (`llms.txt`, `llm-info.json`, `agent-skills`, etc.). Agents may crawl and read everything anonymously.

## Current state
- There is **no protected agent API** — every page, the product catalog, and every discovery document can already be read anonymously.
- An OAuth 2.0 layer is published anyway for agents that prefer to authenticate: [`/.well-known/oauth-authorization-server`](/.well-known/oauth-authorization-server) and [`/.well-known/oauth-protected-resource`](/.well-known/oauth-protected-resource). Every endpoint it advertises is real and responds — there is no login or identity check behind it because none is needed for public content; it issues real, verifiable, read-scoped tokens on request.

## Agent registration (anonymous, real endpoints)
- **Audience:** any AI agent or crawler.
- **Registration:** `POST /oauth/register` with `{"identity_type": "anonymous"}` → returns a `client_id` and a signed RS256 `access_token` (bearer, `scope: read`, 1 hour lifetime).
- **Token endpoint:** `POST /oauth/token` with `grant_type=client_credentials` → same anonymous, read-scoped token.
- **Verify a token:** `POST /oauth/introspect` with `{"token": "..."}`.
- **Revoke:** `POST /oauth/revoke` — accepted for compatibility; tokens are stateless and short-lived, nothing further to invalidate server-side.
- **Public key:** [`/.well-known/jwks.json`](/.well-known/jwks.json) — verify tokens yourself instead of calling `/oauth/introspect` if you prefer.
- **Credential use:** the token is not required to read anything on inch.hr. It exists so agents that require a bearer token before calling an API have one that is genuinely valid.

## Future
If a protected or write-capable agent API is ever added (e.g. an agent placing an order on a user's behalf), it will require a real identity assertion and a narrower scope than `read` — this document will be updated then.

## Public resources for agents
- [llms.txt](/llms.txt) · [llm-info.json](/llm-info.json) · [llm-info.md](/llm-info.md)
- [sitemap.xml](/sitemap.xml) · [robots.txt](/robots.txt)
- [Agent Skills index](/.well-known/agent-skills/index.json)
- [MCP server card](/.well-known/mcp/server-card.json) · [API catalog](/.well-known/api-catalog)