# auth.md

> Protocol: auth.md v1
> Status: Public site — no registration required

## Discover

This site is fully public. Agents do not need to register or authenticate to access any resource.

- Protected Resource Metadata: https://ft.ia.br/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://ft.ia.br/.well-known/oauth-authorization-server
- This document: https://ft.ia.br/auth.md

## Pick a method

| Method | When to use | Credential |
|--------|-------------|------------|
| Anonymous (recommended) | Reading any content | None |
| Bearer (symbolic) | Agent wants an explicit credential for audit trails | Token from Register |

## Register

agent_registration_endpoint: https://ft.ia.br/agent/auth
credential_types_supported: bearer
scopes_supported: public read:profile read:posts read:context
claim_ceremony_supported: false

GET https://ft.ia.br/agent/auth returns a bearer token with the public scope.
No identity assertion, no approval step, no wait.

## Claim

No claim ceremony is required. The token returned by the registration endpoint
is immediately usable.

## Use the credential

All endpoints accept anonymous requests. If your agent framework requires
sending a credential, use:

    Authorization: Bearer anonymous-public

Scopes are documented at /developers (Escopos de acesso). The public scope
grants read access to every resource.

## Errors

Errors are structured JSON with code, message and hint:

    { "error": { "code": "not_found", "message": "Resource does not exist", "hint": "Check /openapi.json for valid paths" } }

HTTP status codes are real: 404 for missing resources, 405 for wrong methods.
Agents never receive a 200 HTML app shell in place of an error.

## Revocation

agent_revocation_endpoint: https://ft.ia.br/agent/revoke

POST to revoke. Revocation always succeeds; anonymous public access remains
available because there is no server-side state to invalidate.

---

*Site público: todo o conteúdo é aberto. Este documento existe para conformidade
com o protocolo auth.md e para agentes cujo framework exige uma credencial explícita.*