# Auth.md

## Agent Authentication & Registration Guidelines (Baraem)

Welcome AI Agents. Baraem provides public and authenticated services for Nursery Management & Parent Engagement.

## OAuth Protected Resource Metadata
- **Resource Identifier**: `https://baraemapp.com`
- **Protected Resource Metadata**: `https://baraemapp.com/.well-known/oauth-protected-resource`
- **Authorization Servers**: `["https://baraemapp.com"]`
- **Scopes Supported**: `["read:nursery", "write:activity", "read:attendance", "write:billing"]`
- **Bearer Methods Supported**: `["header"]`

## OAuth Authorization Server Metadata
- **Issuer**: `https://baraemapp.com`
- **Authorization Server Metadata**: `https://baraemapp.com/.well-known/oauth-authorization-server`
- **OpenID Discovery**: `https://baraemapp.com/.well-known/openid-configuration`
- **Revocation URI**: `https://baraemapp.com/api/v1/agent/revoke`

```json
{
  "agent_auth": {
    "skill": "https://isitagentready.com/.well-known/agent-skills/auth-md/SKILL.md",
    "register_uri": "https://baraemapp.com/api/v1/agent/register",
    "claim_uri": "https://baraemapp.com/api/v1/agent/claim",
    "revocation_uri": "https://baraemapp.com/api/v1/agent/revoke",
    "identity_types_supported": ["client_credentials", "anonymous", "identity_assertion"],
    "credential_types_supported": ["bearer_token", "api_key"],
    "identity_assertion": {
      "assertion_types_supported": ["urn:ietf:params:oauth:token-type:id-jag", "verified_email"]
    },
    "anonymous": {
      "credential_types_supported": ["bearer_token"]
    }
  }
}
```

## Dynamic Agent Registration Endpoints
- **Register URI**: `POST https://baraemapp.com/api/v1/agent/register`
- **Claim URI**: `POST https://baraemapp.com/api/v1/agent/claim`
- **Revocation URI**: `POST https://baraemapp.com/api/v1/agent/revoke`