# auth.md

You are an agent. **Salon KiTCut** (`https://www.kitcut.cz`) publishes a **public, read-only** site content API. There is no booking, payment, account, or write API — appointments are phone-only.

**Do not register for credentials.** Published GET resources require no bearer token. The OAuth discovery documents below exist so agents can find this policy; registration endpoints are **not operated**.

## Audience

Agents that need salon facts (services, prices, team phones, address, opening hours) for a human in Prague.

## Step 1 — Discover

### 1a. Protected Resource Metadata

```http
GET /.well-known/oauth-protected-resource
```

```json
{
  "resource": "https://www.kitcut.cz/",
  "resource_name": "Salon KiTCut",
  "authorization_servers": ["https://www.kitcut.cz/"],
  "scopes_supported": ["site.read"],
  "bearer_methods_supported": ["header"]
}
```

`site.read` means unauthenticated GET of published salon content. No other scopes exist.

### 1b. Authorization Server metadata

```http
GET /.well-known/oauth-authorization-server
```

Read `issuer` (must be `https://www.kitcut.cz`) and the `agent_auth` block (`skill`, `register_uri`, identity types, credential types, `claim_uri`, `revocation_uri`). Then follow Step 2 — do **not** POST to `register_uri`, `claim_uri`, or `revocation_uri`.

## Step 2 — Registration method

**None for this service.** Identity type `anonymous` is advertised only for discovery completeness; there is no live registration runtime and no credentials are issued.

If you already hold a bearer token from elsewhere, do not send it here — it is unused.

## Step 3 — Use the public API

Prefer these unauthenticated GETs:

| Resource | URL |
| --- | --- |
| This document | `https://www.kitcut.cz/auth.md` |
| LLM site index | `https://www.kitcut.cz/llms.txt` |
| API catalog | `https://www.kitcut.cz/.well-known/api-catalog` |
| OpenAPI | `https://www.kitcut.cz/openapi.json` |
| API docs | `https://www.kitcut.cz/api/docs.md` |
| Health | `https://www.kitcut.cz/api/status.json` |
| Homepage (markdown) | `GET /` with `Accept: text/markdown` |

## Step 4 — Bookings (humans only)

There is no agent booking endpoint. Surface the team phone numbers from `/llms.txt` or the homepage and let the human call.

## Step 5 — Revocation

Not applicable — no access tokens are issued.