# auth.md

Gaier Lighting supports agentic registration.

## Discover

- Protected Resource Metadata: https://gaierlighting.com/.well-known/oauth-protected-resource
- Authorization Server Metadata: https://gaierlighting.com/.well-known/oauth-authorization-server

Read the `agent_auth` block for skill, identity_endpoint, claim_endpoint, identity_types_supported, and identity_assertion.assertion_types_supported.

## Register

register_uri: https://gaierlighting.com/agent/identity

### 1. Anonymous Registration
```http
POST https://gaierlighting.com/agent/identity HTTP/1.1
Host: gaierlighting.com
Content-Type: application/json

{"type": "anonymous"}
```

Response:
```json
{"identity_assertion": "ey...", "assertion_expires": 3600}
```

### 2. Identity Assertion Registration
Check `identity_assertion.assertion_types_supported` first.

```http
POST https://gaierlighting.com/agent/identity HTTP/1.1
Host: gaierlighting.com
Content-Type: application/json

{"type": "identity_assertion", "assertion_type": "urn:ietf:params:oauth:token-type:id-jag", "assertion": "ey..."}
```

Response:
```json
{"identity_assertion": "ey...", "assertion_expires": 3600}
```

## Claim ceremony

Use the claim_endpoint from agent_auth with grant_type urn:workos:agent-auth:grant-type:claim

## Exchange the assertion

```http
POST https://gaierlighting.com/oauth2/token HTTP/1.1
Host: gaierlighting.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=ey...
```

## Use the access_token

Authorization: Bearer <access_token>

## Revocation

POST https://gaierlighting.com/oauth2/revoke