# auth.md — agent authentication for code1.ru (AIV)

This site exposes a real MCP server at `https://code1.ru/mcp` with the
`request_consultation` tool. Anonymous calls are accepted today; the OAuth
layer below is live groundwork for authenticated, per-agent access.

## OAuth 2.0

- Issuer: `https://code1.ru`
- Metadata: `https://code1.ru/.well-known/oauth-authorization-server`
- Protected resource: `https://code1.ru/.well-known/oauth-protected-resource`
- JWKS: `https://code1.ru/.well-known/jwks.json`

## Registration flow (self-contained)

**Step 1 — Register your agent (RFC 7591 dynamic client registration):**

```
POST https://code1.ru/oauth/register
Content-Type: application/json

{ "client_name": "my-agent" }
```

Response: `{ "client_id": "agent-...", "grant_types": ["client_credentials"], "scope": "consultation:write" }`

**Step 2 — Obtain an access token (client_credentials grant):**

```
POST https://code1.ru/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=consultation:write
```

Response: `{ "access_token": "<ES256 JWT>", "token_type": "Bearer", "expires_in": 3600 }`

**Step 3 — Call the protected resource:**

```
POST https://code1.ru/mcp
Authorization: Bearer <access_token>
Content-Type: application/json

{ "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "request_consultation",
    "arguments": { "name": "...", "contact": "...", "task": "..." } } }
```

**Step 4 — Revoke (RFC 7009), optional:**

```
POST https://code1.ru/oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=<access_token>
```

Verify tokens against the JWKS at `https://code1.ru/.well-known/jwks.json` (ES256).
Machine-readable registration metadata: the `agent_auth` block in
`https://code1.ru/.well-known/oauth-authorization-server`.