# auth.md

You are an agent. [https://www.fiorlaw.com](https://www.fiorlaw.com) is the public website of FIOR Avukatlık Bürosu. It has no user accounts, no protected APIs, and does not issue credentials. Read pages as HTML or Markdown (`Accept: text/markdown`). Do not register.

Discovery documents exist so you can learn this policy. Treat Protected Resource Metadata as authoritative if anything here conflicts.

## Discover

Two hops. A 401 may include:

```http
WWW-Authenticate: Bearer resource_metadata="https://www.fiorlaw.com/.well-known/oauth-protected-resource"
```

If you have no 401, fetch these documents directly:

- Protected Resource Metadata (RFC 9728) — [https://www.fiorlaw.com/.well-known/oauth-protected-resource](https://www.fiorlaw.com/.well-known/oauth-protected-resource)
- Authorization Server Metadata (RFC 8414) — [https://www.fiorlaw.com/.well-known/oauth-authorization-server](https://www.fiorlaw.com/.well-known/oauth-authorization-server)

### Protected Resource Metadata

```http
GET https://www.fiorlaw.com/.well-known/oauth-protected-resource
```

```json
{
  "resource": "https://www.fiorlaw.com",
  "resource_name": "FIOR Avukatlık Bürosu",
  "authorization_servers": ["https://www.fiorlaw.com"],
  "scopes_supported": ["read"],
  "bearer_methods_supported": ["header"]
}
```

`scopes_supported` lists `read` for public page access. Public pages do not require a bearer token.

### Authorization Server Metadata

```http
GET https://www.fiorlaw.com/.well-known/oauth-authorization-server
```

Read `issuer` (`https://www.fiorlaw.com`) and the `agent_auth` block:

- `skill` — this file ([https://www.fiorlaw.com/auth.md](https://www.fiorlaw.com/auth.md))
- `register_uri` — [https://www.fiorlaw.com/agent/auth](https://www.fiorlaw.com/agent/auth)
- `claim_uri` — [https://www.fiorlaw.com/agent/claim](https://www.fiorlaw.com/agent/claim)
- `revocation_uri` — [https://www.fiorlaw.com/agent/revoke](https://www.fiorlaw.com/agent/revoke)
- `identity_types_supported` — `anonymous`, `identity_assertion` (ID-JAG `urn:ietf:params:oauth:token-type:id-jag`)
- `anonymous.credential_types_supported` / `identity_assertion.credential_types_supported` — `access_token`

## Registration

Do not POST to `register_uri`. This origin does not provision agent credentials. Reserved registration URLs return:

```json
{
  "error": "access_denied",
  "error_description": "https://www.fiorlaw.com does not accept agent registration. Public site resources do not require authentication."
}
```

Advertised methods exist only so discovery can describe the policy:

| Agent has | Advertised type | Outcome |
| --- | --- | --- |
| ID-JAG for this audience | `identity_assertion` + `urn:ietf:params:oauth:token-type:id-jag` | `access_denied` |
| User email only | not used | do not register |
| Neither | `anonymous` | `access_denied` |

There is no claim ceremony and no token exchange. `token_endpoint` (`https://www.fiorlaw.com/oauth/token`) also returns `access_denied`.

## Credentials

No access tokens or API keys are issued. Call the public site without `Authorization`. Human-facing docs: [https://www.fiorlaw.com/docs](https://www.fiorlaw.com/docs).

## Revocation

Nothing is issued, so there is nothing to revoke. `revocation_uri` and `revocation_endpoint` (`https://www.fiorlaw.com/oauth/revoke`) return the same `access_denied` document.