# Auth.md

## Authentication policy for spa-cz.com

The public machine-readable resources on spa-cz.com are read-only and do not require authentication.

## Public resources
- Homepage: https://spa-cz.com/
- llms.txt: https://spa-cz.com/llms.txt
- Sitemap: https://spa-cz.com/sitemap_index.xml
- API catalog: https://spa-cz.com/.well-known/api-catalog
- MCP server card: https://spa-cz.com/.well-known/mcp/server-card.json
- Agent card: https://spa-cz.com/.well-known/agent-card.json

## Agent registration
No agent registration is required for read-only public discovery. Agents can use the public resources above without OAuth, API keys, cookies, or write permissions.

~~~yaml
agent_auth:
  skill: https://spa-cz.com/auth.md
  audience: public-ai-agents
  register_uri: https://spa-cz.com/auth.md
  claim_uri: https://spa-cz.com/agent/auth/claim
  revocation_uri: https://spa-cz.com/agent/auth/revoke
  identity_endpoint: https://spa-cz.com/agent/auth
  claim_endpoint: https://spa-cz.com/agent/auth/claim
  revocation_endpoint: https://spa-cz.com/agent/auth/revoke
  identity_types_supported:
    - anonymous
  credential_types_supported:
    - bearer
  anonymous:
    credential_types_supported:
      - bearer
    claim_uri: https://spa-cz.com/agent/auth/claim
  methods:
    - type: anonymous
      name: anonymous-public-read
      description: No registration or credential issuance is required for read-only public discovery.
      credential_use: bearer
      credential_types_supported:
        - bearer
      identity_endpoint: https://spa-cz.com/agent/auth
      claim_uri: https://spa-cz.com/agent/auth/claim
      revocation_uri: https://spa-cz.com/agent/auth/revoke
      resources:
        - https://spa-cz.com/llms.txt
        - https://spa-cz.com/sitemap_index.xml
        - https://spa-cz.com/openapi.json
        - https://spa-cz.com/.well-known/api-catalog
~~~

## Registration flow for agents
1. Fetch "/.well-known/oauth-protected-resource".
2. Fetch "/.well-known/oauth-authorization-server".
3. Read "agent_auth.skill", "agent_auth.identity_endpoint", "agent_auth.claim_endpoint", "agent_auth.revocation_endpoint", "agent_auth.identity_types_supported", and "agent_auth.credential_types_supported".
4. For this public read-only site, use the anonymous method and scope "public.read".
5. No public mutation, booking, payment, or medical-record credential is issued by this discovery layer.

## Write access
No public write, purchase, medical-record, or booking mutation API is exposed for agents.