# auth.md

You are an agent. This file is the Skillselion `agent_auth` recipe (RFC 9728 + RFC 8414). The public catalog is **unauthenticated**. Follow the numbered sections in order.

## 1. Discover

```
GET https://www.skillselion.com/.well-known/oauth-protected-resource
```

Expect HTTP 200 and `Content-Type` JSON. Read `resource`, `authorization_servers`, `resource_documentation`, `bearer_methods_supported`, and `identity_types_supported` (`anonymous` only: the public catalog needs no credential. `anonymous.credential_types_supported` is empty. This origin does not issue `identity_assertion` credentials).

```
GET https://www.skillselion.com/.well-known/oauth-authorization-server
```

Expect HTTP 200. Confirm `issuer` is this origin, `grant_types_supported` is `[]`, and `agent_auth.register_uri` is `https://www.skillselion.com/oauth/register`. This origin publishes RFC 8414 metadata so discovery is reachable. This origin does not issue access tokens. There is no `identity_assertion` or `id-jag` product.

These discovery endpoints also return HTTP 200 and explain that no tokens are issued:

```
GET https://www.skillselion.com/oauth/authorize
GET https://www.skillselion.com/oauth/token
GET https://www.skillselion.com/oauth/register
```

## 2. Pick a method

Pick **none**. The public catalog does not use OAuth, API keys, or cookies. Do not start authorization_code, client_credentials, or device flow. `grant_types_supported` is empty on purpose.

## 3. Register

Do not register a client. `register_uri` exists so the URL is reachable; GET explains `authorization_server_not_offered`. Do not POST `/oauth/register`.

## 4. Claim

There is no credential to claim. Skillselion does not mint tokens, DCR clients, or identity assertions. Skip claim.

## 5. Use credential

There is no credential. Call the public catalog with no `Authorization` header:

```
GET https://www.skillselion.com/api/v1/listings?q=design&type=skill&limit=10
```

Expect HTTP 200. Send `Accept: application/json` and optional `API-Version: 1`. The body is a pagination envelope (`items`, `limit`, `offset`, `hasMore`, `next`, `pageToken`, `cursor`).

You also do **not** need OAuth, an API key, or a user account to browse the site, read `/openapi.json`, run `npx -y skillselion-mcp`, POST the MCP handshake, or POST NLWeb `/ask`.

## 6. Errors

Staff JSON routes without a Bearer JWT return HTTP 401 and:

`WWW-Authenticate: Bearer realm="skillselion", resource_metadata="https://www.skillselion.com/.well-known/oauth-protected-resource"`

That `WWW-Authenticate` header is how an agent finds this recipe after a 401. Probe paths include `/agent/auth`, `/api`, `/oauth/resource`, and `/api/v1/auth/me`. Do not request them as walkthrough GETs. Human login lives at [/login](https://www.skillselion.com/login) and is **not** an API OAuth product.

Public catalog errors are JSON with `code`, `message`, and `resolution`. A 429 includes `Retry-After`.

## 7. Revocation

There is no token to revoke. There is no public webhook product for catalog consumers.