# Thistinct auth.md

You are an agent. Thistinct publishes agent registration metadata so you can discover how to call the studio APIs.

The public inquiry API (`POST /api/contact`) does **not** require a bearer token. Registering is optional and is for agents that want a client identity on file.

## Step 1 — Discover

### 1a. Protected Resource Metadata

```http
GET https://thistinct.dev/.well-known/oauth-protected-resource
```

- `resource` is `https://thistinct.dev/`
- `authorization_servers` is `["https://thistinct.dev"]`
- `scopes_supported` includes `inquiry:write`
- `bearer_methods_supported` includes `header`

### 1b. Authorization Server metadata

```http
GET https://thistinct.dev/.well-known/oauth-authorization-server
```

Read `issuer` (`https://thistinct.dev`), `token_endpoint`, `jwks_uri`, and the `agent_auth` block (`register_uri`, identity types, claim/revocation URLs).

OIDC discovery is also published at `/.well-known/openid-configuration`.

## Step 2 — Pick a method

Supported identity types (see `agent_auth.identity_types_supported`):

1. **anonymous** — register without a user identity. Preferred for public inquiries.
2. **identity_assertion** — `urn:ietf:params:oauth:token-type:id-jag` or `verified_email`.

## Step 3 — Register

```http
POST https://thistinct.dev/agent/register
Content-Type: application/json

{
  "type": "anonymous",
  "client_name": "Example Agent",
  "client_uri": "https://example.com"
}
```

You receive a `client_id`. The inquiry API remains callable without presenting that id.

For verified email:

```json
{
  "type": "identity_assertion",
  "assertion_type": "verified_email",
  "email": "operator@example.com",
  "client_name": "Example Agent"
}
```

Claim completion (when issued): `POST https://thistinct.dev/agent/claim`.

## Step 4 — Call the API

```http
POST https://thistinct.dev/api/contact
Content-Type: application/json

{
  "firstName": "Ada",
  "lastName": "Lovelace",
  "email": "ada@example.com",
  "message": "Project brief"
}
```

Optional: `Authorization: Bearer <token>` if you completed a token exchange at `https://thistinct.dev/oauth/token`. Tokens are not required for inquiries.

MCP alternative: `https://thistinct.dev/mcp` tool `submit_inquiry`.

## Revocation

`POST https://thistinct.dev/oauth/revoke` with `token` (form or JSON).