# Auth.md

Agent authentication for **gksafety.se** (GK Safety AB).

- Site: https://gksafety.se
- Contact: info@gksafety.se
- Protected resource metadata: https://gksafety.se/.well-known/oauth-protected-resource
- Authorization server metadata: https://gksafety.se/.well-known/oauth-authorization-server
- OpenID Connect discovery: https://gksafety.se/.well-known/openid-configuration
- MCP server card: https://gksafety.se/.well-known/mcp/server-card.json

## Public resources

The GK Safety course feed and documentation are public and require **no
authentication**:

- `https://gksafety.se/api/courses.json`
- `https://gksafety.se/api/openapi.json`
- `https://gksafety.se/.well-known/api-catalog`

Agents should use these endpoints instead of scraping the site.

## Agent audience

This registration flow is for AI agents and MCP clients acting on behalf of a
signed-in GK Safety user. Customer, LMS and booking functionality is protected.
Backend policies limit every connection to data and actions the user may
already access.

## Register an agent client

1. Fetch `https://gksafety.se/.well-known/oauth-protected-resource` and use its
   `authorization_servers` entry as the canonical OAuth issuer.
2. Fetch that issuer's RFC 8414 metadata. The `registration_endpoint` is the
   agent registration URI.
3. Register with an HTTPS `POST` to
   `https://kyiksquombyfwgyqkhfe.supabase.co/auth/v1/oauth/clients/register`.
   Send an OAuth Dynamic Client Registration document containing at least
   `client_name`, `redirect_uris`, `grant_types: ["authorization_code"]`,
   `response_types: ["code"]`, and `token_endpoint_auth_method: "none"` for a
   public PKCE client.
4. Start an OAuth 2.1 authorization-code flow with PKCE (`S256`) and request
   only `openid email profile`. The user signs in and approves access on the GK
   Safety consent screen.
5. Exchange the authorization code at the discovered `token_endpoint`.
6. Present the resulting access token to protected endpoints as
   `Authorization: Bearer <access_token>`. Never place credentials in a URL.

Identity type: `human_delegated`. Anonymous, machine and service-account
registration are not supported. Credential types are
`oauth2_authorization_code_pkce` and `bearer_access_token`; API keys and the
client-credentials grant are not supported.

The standard identity claims endpoint is the discovered `userinfo_endpoint`.
Users can revoke a connection from their account or request revocation at
https://gksafety.se/kontakt. Connection instructions for common MCP clients are
available at https://gksafety.se/connect.

## Content usage

Declared via Content Signals in `https://gksafety.se/robots.txt`.

## Agent registration metadata

Same block as published in
`https://gksafety.se/.well-known/oauth-authorization-server`:

```json
{
  "agent_auth": {
    "skill": "https://gksafety.se/auth.md",
    "register_uri": "https://kyiksquombyfwgyqkhfe.supabase.co/auth/v1/oauth/clients/register",
    "registration_methods_supported": ["oauth_dynamic_client_registration"],
    "identity_types_supported": ["human_delegated"],
    "human_delegated": {
      "authorization_grant_types_supported": ["authorization_code"],
      "pkce_code_challenge_methods_supported": ["S256"],
      "credential_types_supported": ["bearer_access_token"]
    },
    "credential_types_supported": ["oauth2_authorization_code_pkce", "bearer_access_token"],
    "claim_uri": "https://kyiksquombyfwgyqkhfe.supabase.co/auth/v1/oauth/userinfo",
    "contact": "info@gksafety.se"
  }
}
```