# Auth.md

## 10NZ.X Agent Authentication

Site: https://10nz.xyz
Contact: hello@10nz.xyz

## Overview

The 10NZ.X public discovery API (`/api/public/*`) is **unauthenticated**.
Agents may call it directly without registration or credentials.

For access to private tenant data or write operations, agents must register
and authenticate via the endpoints below.

## Agent Registration

- register_uri: https://10nz.xyz/api/public/agents/register
- Method: POST
- Content-Type: application/json
- Body: { "name": "<agent name>", "operator": "<org or email>", "purpose": "<free text>" }

Registration is currently manual — submit the payload above and a 10NZ.X
operator will provision credentials out-of-band. Automated self-service
registration is on the roadmap.

## Supported Identity Types

- `agent` — autonomous AI agent acting on behalf of an operator
- `service` — server-to-server integration
- `user-delegated` — agent acting on behalf of an end user

## Supported Credential Types

- `none` — for public discovery endpoints
- `bearer` — opaque bearer token issued at registration (planned)
- `oauth2` — OAuth 2.0 authorization code flow (planned)

## Discovery

- OAuth authorization server metadata: https://10nz.xyz/.well-known/oauth-authorization-server
- OpenID configuration: https://10nz.xyz/.well-known/openid-configuration
- Protected resource metadata: https://10nz.xyz/.well-known/oauth-protected-resource
- API catalog: https://10nz.xyz/.well-known/api-catalog
- Agent card: https://10nz.xyz/.well-known/agent-card.json
- MCP server card: https://10nz.xyz/.well-known/mcp/server-card.json

## Claim & Revocation

- claim_uri: https://10nz.xyz/api/public/agents/register
- revocation_uri: mailto:hello@10nz.xyz?subject=Agent%20credential%20revocation

## Rate Limits

Public endpoints: 60 requests per minute per IP. Contact hello@10nz.xyz for
higher limits.