# auth.md — metoz.de Agent Access & Registration

metoz.de provides open, public access for humans and autonomous AI agents to audit website crawler visibility, robots.txt AI rules, and JavaScript rendering differences.

## Public Access & No Authentication Required

For standard scan requests, **no authentication or API key is required**. AI agents can call the scan endpoint directly:

```http
POST https://metoz.de/api/scan
Content-Type: application/json

{
  "url": "https://example.com"
}
```

## OAuth & Agent Discovery Metadata

- **OAuth Protected Resource Metadata (RFC 9728)**: [/.well-known/oauth-protected-resource](https://metoz.de/.well-known/oauth-protected-resource)
- **OAuth Authorization Server Metadata (RFC 8414)**: [/.well-known/oauth-authorization-server](https://metoz.de/.well-known/oauth-authorization-server)
- **OpenID Connect Discovery**: [/.well-known/openid-configuration](https://metoz.de/.well-known/openid-configuration)
- **MCP Server Card (SEP-1649)**: [/.well-known/mcp/server-card.json](https://metoz.de/.well-known/mcp/server-card.json)
- **Agent Skills**: [/.well-known/agent-skills/index.json](https://metoz.de/.well-known/agent-skills/index.json)

## Supported Scopes

- `read:scan`: Read and execute web crawler scans.
- `write:scan`: Request new URL audits.
- `public`: General open data queries.

## Agent Identity & Credential Registration

If high-volume or rate-limit exemptions are required, agents can register using automated assertion flows:

- **Registration Endpoint**: `https://metoz.de/agent/auth`
- **Claim Endpoint**: `https://metoz.de/agent/claim`
- **Supported Identity Types**:
  - `anonymous`: Ephemeral bearer token provisioning.
  - `identity_assertion`: Cryptographically verified ID-JAG (`urn:ietf:params:oauth:token-type:id-jag`) or verified email assertions.
- **Bearer Method**: Authorization HTTP Request Header (`Authorization: Bearer <token>`).