# Auth.md

You are an agent. Nuri exposes a public, read-only agent registration path for website discovery, plus a public Bitcoin shop with a machine-readable catalogue and an x402 checkout challenge. Private account actions, balances, identity checks, card actions, support tickets, and transaction history are not available through this public website surface.

Resource server: https://www.nuri.com
Authorization server: https://www.nuri.com

## Shop (agentic commerce)

- Product feed (ACP/UCP/Merchant): https://www.nuri.com/shop/feed.json
- Agentic commerce discovery: https://www.nuri.com/.well-known/agentic-commerce.json
- x402 checkout: https://www.nuri.com/shop/checkout?sku=PRODUCT_SLUG (returns an HTTP 402 payment challenge; no funds are captured)
- MCP tools: list_shop_products, get_product (endpoint https://www.nuri.com/mcp)

## Step 1 - Discover

Fetch the Protected Resource Metadata and Authorization Server metadata:

```http
GET https://www.nuri.com/.well-known/oauth-protected-resource
Accept: application/json
```

```http
GET https://www.nuri.com/.well-known/oauth-authorization-server
Accept: application/json
```

Important metadata fields:

- `agent_auth.skill`: https://www.nuri.com/auth.md
- `agent_auth.register_uri`: https://www.nuri.com/agent/auth
- `agent_auth.claim_uri`: https://www.nuri.com/agent/auth/claim
- `agent_auth.revocation_uri`: https://www.nuri.com/agent/auth/revoke
- `agent_auth.identity_types_supported`: anonymous
- `agent_auth.anonymous.credential_types_supported`: access_token

## Step 2 - Pick a Method

Use `anonymous` registration for public read-only access to the Nuri website metadata. Identity assertion is not enabled on this website.

## Step 3 - Register

```http
POST https://www.nuri.com/agent/auth
Content-Type: application/json
Accept: application/json
```

```json
{
  "type": "anonymous",
  "requested_credential_type": "access_token"
}
```

Successful response shape:

```json
{
  "registration_id": "reg_public_site",
  "registration_type": "anonymous",
  "credential_type": "access_token",
  "credential": "nuri_public_site_readonly_token",
  "credential_expires": null,
  "scopes": ["public:read"]
}
```

## Step 4 - Use Public Surfaces

The published public surfaces are already readable without private account access:

- https://www.nuri.com/
- https://www.nuri.com/bitcoin-deutschland/
- https://www.nuri.com/de/
- https://www.nuri.com/bitcoin-espana/
- https://www.nuri.com/bitcoin-italia/
- https://www.nuri.com/es/
- https://www.nuri.com/it/
- https://www.nuri.com/privacy-policy
- https://www.nuri.com/terms-of-service
- https://www.nuri.com/llms.txt
- https://www.nuri.com/llms-full.txt
- https://www.nuri.com/mcp

## Errors

| Code | Where | What to do |
| --- | --- | --- |
| `anonymous_not_enabled` | `/agent/auth` | Stop; private auth is not available on the public website. |
| `unsupported_credential_type` | `/agent/auth` | Retry with `requested_credential_type: "access_token"`. |
| `identity_assertion_not_enabled` | `/agent/auth` | Do not send an ID-JAG to this public site. |
| `claim_not_required` | `/agent/auth/claim` | Continue with anonymous read-only access. |
| `rate_limited` | any endpoint | Back off and retry later. |

## Revocation

Agents do not need to initiate revocation for this public read-only token. If a previously accepted credential returns 401, discard it and restart at Step 1.