# auth.md

## Audience

This document is for AI agents that want to discover and use Felipe Rodrigues' public portfolio API.

## Authentication status

The API is public, read-only, and currently requires no account, API key, bearer token, or OAuth grant. Do not send personal data or secrets. Available resources are documented at https://www.lipeconsultor.com/docs/api.

## Discover

1. Fetch the protected resource metadata at https://www.lipeconsultor.com/.well-known/oauth-protected-resource.
2. Fetch the agent authorization metadata at https://www.lipeconsultor.com/.well-known/oauth-authorization-server.
3. Use the anonymous `public_access` method described below.

## Register public agent access

Registration is optional and stateless. It creates no account and issues no credential.

```http
POST /agent/auth
Content-Type: application/json

{
  "type": "anonymous",
  "requested_credential_type": "public_access"
}
```

The response confirms public access to the `portfolio.read` scope. No claim ceremony or revocation endpoint applies because no secret or persistent registration is created.

## Claim status

The anonymous registration method publishes https://www.lipeconsultor.com/agent/auth/claim as its claim-status endpoint. A GET or POST request returns `claim_required: false`: public access cannot be claimed, transferred, or revoked, and the endpoint never asks for personal data or sends email.

## Use the API

Call the documented GET or HEAD endpoints without an Authorization header. Start with https://www.lipeconsultor.com/api/ or discover the OpenAPI document at https://www.lipeconsultor.com/openapi.json.

## Protected access

No protected agent API is currently offered. For a future private integration, contact Felipe Rodrigues through https://www.lipeconsultor.com/#contato; do not attempt automated account creation or credential probing.