# auth.md — Tharsis Felix AI Agent Authentication and Registration

## Audience
This document is for autonomous AI agents, LLM assistants, and automated systems interacting with the Tharsis Felix Performance Marketing and Telemetry services.

## Discovery
- Resource Server: https://tharsisfelix.com.br
- HTTP Message Signatures Directory (Web Bot Auth): https://tharsisfelix.com.br/.well-known/http-message-signatures-directory
- JWKS URI: https://tharsisfelix.com.br/.well-known/jwks.json
- Protected Resource Metadata: https://tharsisfelix.com.br/.well-known/oauth-protected-resource
- Authorization Server: https://tharsisfelix.com.br/.well-known/oauth-authorization-server
- OpenID Configuration: https://tharsisfelix.com.br/.well-known/openid-configuration
- MCP Server Card: https://tharsisfelix.com.br/.well-known/mcp/server-card.json
- ARD Manifest: https://tharsisfelix.com.br/.well-known/ai-catalog.json

## Web Bot Auth (RFC 9421 & IETF draft-meunier-http-message-signatures-directory)
The `tharsisfelix.com.br` bot and autonomous agents identify themselves and sign outgoing HTTP requests using cryptographic HTTP Message Signatures. Receiving sites (including Cloudflare Bot Management and partner APIs) verify these signatures using our public key directory.

- **Directory Endpoint**: `https://tharsisfelix.com.br/.well-known/http-message-signatures-directory`
- **Content-Type**: `application/http-message-signatures-directory+json`
- **Algorithm**: `Ed25519` (`kty`: `OKP`, `crv`: `Ed25519`)
- **Key ID (`kid`)**: `4IlFmL5386yvsKEb-NXiK-ghMQD0e7pz9aD3OLPJgKc`

### Outgoing Signed Request Format
When making agentic requests, the bot attaches the following HTTP fields:

```http
Signature-Agent: "https://tharsisfelix.com.br"
Signature-Input: sig1=("@authority" "signature-agent");created=1787954798;keyid="4IlFmL5386yvsKEb-NXiK-ghMQD0e7pz9aD3OLPJgKc";alg="ed25519";expires=1787955098;tag="web-bot-auth"
Signature: sig1=:<base64url-signature>:
```

### Signer Utility
A production Node.js signing script is available in the repository at `scripts/web-bot-auth-signer.js`.
```bash
node scripts/web-bot-auth-signer.js sign example.com
```

## Registration and Authentication Methods

### 1. Anonymous Access (Ephemeral Diagnostics)
- Supported Identity Types: anonymous
- Claim URI: https://tharsisfelix.com.br/agent/claim
- Credential Types: ephemeral_token
- Scopes: read:analytics, read:case_studies

### 2. Verified Email Assertion
- Supported Identity Types: identity_assertion
- Assertion Types Supported: verified_email
- Claim URI: https://tharsisfelix.com.br/agent/claim
- Credential Types: bearer_token, api_key
- Scopes: read:analytics, read:case_studies, write:consulting_request

### 3. ID-JAG (Identity Assertion JWT)
- Supported Identity Types: identity_assertion
- Assertion Types Supported: urn:ietf:params:oauth:token-type:id-jag
- Register URI: https://tharsisfelix.com.br/agent/auth
- Claim URI: https://tharsisfelix.com.br/agent/claim
- Credential Types: bearer_token, api_key
- Scopes: read:analytics, write:consulting_request, read:case_studies, read:profile

## Credential Usage
All authenticated requests must include the Bearer token in the HTTP Authorization header:
```http
Authorization: Bearer <access_token>
```
Bearer methods supported: header (per RFC 6750 and RFC 9728).

## Supported Scopes
- read:analytics: Query aggregated performance and traffic telemetry.
- read:case_studies: Access verified e-commerce case study metrics and ROAS benchmarks.
- write:consulting_request: Submit strategic traffic audit applications.
- read:profile: Read consultant profile and contact info.