---
issuer: https://brante.dev
authorization_endpoint: https://brante.dev/oauth/authorize
token_endpoint: https://brante.dev/oauth/token
registration_endpoint: https://brante.dev/oauth/register
agent_auth:
  skill: https://brante.dev/auth.md
  register_uri: https://brante.dev/oauth/register
  supported_identity_types:
    - anonymous
    - identity_assertion
    - agent
    - human
    - service
  identity_types_supported:
    - anonymous
    - identity_assertion
  supported_credential_types:
    - bearer_token
    - api_key
  credential_types:
    - bearer_token
    - api_key
  credential_types_supported:
    - bearer_token
    - api_key
  anonymous:
    credential_types_supported:
      - bearer_token
      - api_key
    claim_uri: https://brante.dev/oauth/claim
  identity_assertion:
    assertion_types_supported:
      - urn:ietf:params:oauth:token-type:id-jag
      - verified_email
    credential_types_supported:
      - bearer_token
      - api_key
    claim_uri: https://brante.dev/oauth/claim
  claim_uri: https://brante.dev/oauth/claim
  revocation_uri: https://brante.dev/oauth/revoke
  documentation_uri: https://brante.dev/auth.md
---

# Auth.md

## Agent Authentication & Protocol Metadata — brante.dev

> Official specification and instructions for AI Agent Discovery, Authentication, and Execution on `brante.dev`.

---

## 1. Overview & Identity

- **Host**: `https://brante.dev`
- **Owner**: Benjamín Brante · Brante Dev Solutions
- **Primary Domain**: Web Development, WordPress Security Hardening & Performance (WPO)
- **Supported Identity Types**: `agent`, `human`, `service`, `anonymous`, `identity_assertion`
- **Supported Credential Types**: `bearer_token`, `api_key`, `oauth2`

---

## 2. Discovery Endpoints

| Protocol / Standard | Endpoint | Description |
|---|---|---|
| **API Catalog (RFC 9727)** | `/.well-known/api-catalog` | RFC 9727 linkset of APIs |
| **ARD Manifest** | `/.well-known/ai-catalog.json` | Agentic Resource Discovery catalog |
| **MCP Server Card (SEP-1649)** | `/.well-known/mcp/server-card.json` | Model Context Protocol server capabilities |
| **Agent Skills Index** | `/.well-known/agent-skills/index.json` | Agent Skills Discovery RFC v0.2.0 |
| **OpenID Connect Discovery** | `/.well-known/openid-configuration` | OpenID Connect metadata |
| **OAuth Authorization Server** | `/.well-known/oauth-authorization-server` | RFC 8414 Authorization metadata |
| **OAuth Protected Resource** | `/.well-known/oauth-protected-resource` | RFC 9728 Protected Resource metadata |
| **OpenAPI 3.1 Spec (MPP enabled)** | `/openapi.json` | Machine-readable API schema |
| **x402 Payment Protocol** | `/.well-known/x402` | x402 HTTP Payment Facilitator |
| **Universal Commerce Protocol** | `/.well-known/ucp` | UCP v1.0 Profile |
| **Agentic Commerce Protocol** | `/.well-known/acp.json` | ACP v1.0 Commerce Discovery |

---

## 3. Agent Registration & Authorization

Agents can dynamically discover and register access parameters via OAuth / OIDC:

- **Registration Endpoint**: `https://brante.dev/oauth/register`
- **Authorization Endpoint**: `https://brante.dev/oauth/authorize`
- **Token Endpoint**: `https://brante.dev/oauth/token`
- **JWKS URI**: `https://brante.dev/.well-known/jwks.json`

### Supported Scopes
- `read:audit`: Retrieve public WPO audits, Core Web Vitals reports, and benchmark metrics.
- `execute:wpo`: Request speed analysis for a target URL.
- `scope:calculate`: Generate budget estimates and technical timelines via project configurator logic.
- `contact:send`: Dispatch structured business inquiries or emergency triage requests.

---

## 4. agent_auth Metadata Specification

```json
{
  "agent_auth": {
    "skill": "https://brante.dev/auth.md",
    "register_uri": "https://brante.dev/oauth/register",
    "identity_types_supported": ["anonymous", "identity_assertion"],
    "supported_identity_types": ["anonymous", "agent", "human", "service"],
    "supported_credential_types": ["bearer_token", "api_key"],
    "credential_types": ["bearer_token", "api_key"],
    "credential_types_supported": ["bearer_token", "api_key"],
    "anonymous": {
      "credential_types_supported": ["bearer_token", "api_key"],
      "claim_uri": "https://brante.dev/oauth/claim"
    },
    "identity_assertion": {
      "assertion_types_supported": ["urn:ietf:params:oauth:token-type:id-jag", "verified_email"],
      "credential_types_supported": ["bearer_token", "api_key"],
      "claim_uri": "https://brante.dev/oauth/claim"
    },
    "claim_uri": "https://brante.dev/oauth/claim",
    "revocation_uri": "https://brante.dev/oauth/revoke",
    "documentation_uri": "https://brante.dev/auth.md"
  }
}
```

---

## 5. Rate Limiting & Zero Trust Policy

1. All incoming agent requests MUST include a valid `User-Agent` identifying the agent system (e.g., `MyAgent/1.0 (+https://example.com/agent)`).
2. Requests are governed by Cloudflare WAF Capa 7 rate limiting.
3. Exploits, unauthorized crawling of non-public paths, or bypass attempts will be blocked by Cloudflare WAF.