# auth.md

IA Academia — Agent Registration & Authentication Specification.

## 1. Audience & Overview
This specification defines automated registration, token provisioning, and authorization methods for AI agents interacting with IA Academia (https://iaacademia.com).

## 2. Agent Registration (`agent_auth`)
- **Skill Specification**: `https://iaacademia.com/auth.md`
- **Register URI**: `https://iaacademia.com/api/agent/register`
- **Claim URI**: `https://iaacademia.com/api/agent/claim`
- **Revocation URI**: `https://iaacademia.com/api/agent/revoke`
- **Supported Identity Types**: `["identity_assertion", "domain_verification", "client_credentials", "anonymous"]`
- **Supported Credential Types**: `["bearer_token", "api_key", "jwt_signature"]`

## 3. Standalone Agent Registration Flows

### Flow A: Anonymous / Auto-Provisioning
Agents without pre-existing accounts can request an immediate session credential:
1. Send `POST https://iaacademia.com/api/agent/claim` with `{"identity_type": "anonymous"}`.
2. The server responds with a temporary `bearer_token` and `api_key`.
3. Use the token in the `Authorization: Bearer <token>` HTTP header.

### Flow B: Identity Assertion (ID-JAG / Verified Domain)
1. Send `POST https://iaacademia.com/api/agent/register` containing your agent assertion payload.
2. The server validates the assertion against `/.well-known/http-message-signatures-directory` and returns an OAuth 2.0 Access Token.

## 4. OAuth 2.0 Discovery
- **OAuth Authorization Server**: `https://iaacademia.com/.well-known/oauth-authorization-server`
- **OAuth Protected Resource Metadata**: `https://iaacademia.com/.well-known/oauth-protected-resource`
- **OpenID Connect**: `https://iaacademia.com/.well-known/openid-configuration`
- **Web Bot Auth JWKS**: `https://iaacademia.com/.well-known/http-message-signatures-directory`

## 5. Supported Scopes
- `iaacademia:read_courses`
- `iaacademia:read_news`
- `iaacademia:enroll_student`
- `iaacademia:invoke_assistant`
- `iaacademia:verify_certificate`