# auth.md — Agent Authentication & Registration for lifetest.uk

> Official machine-readable authentication and agent registration guide for `https://lifetest.uk`.

## 1. Public Read Access (No Authentication Required)

All core study resources, practice tests, handbook chapters, OpenAPI specifications, and MCP tools on `https://lifetest.uk` are **publicly accessible without authentication**:
- `GET https://lifetest.uk/api/v1/health`
- `GET https://lifetest.uk/api/v1/exam-rules`
- `GET https://lifetest.uk/api/v1/chapters`
- `GET https://lifetest.uk/api/v1/flashcards`
- `POST https://lifetest.uk/api/mcp`
- `GET https://lifetest.uk/llms.txt` & `GET https://lifetest.uk/llms-full.txt`

## 2. Autonomous Agent Registration (`POST /api/agent/auth`)

Agents requiring a scoped bearer token for authenticated endpoints, higher rate limits, or session tracking can self-register instantaneously with zero human intervention:

```bash
curl -X POST https://lifetest.uk/api/agent/auth \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "example-research-agent",
    "client_uri": "https://example.com",
    "scopes": ["read:tests", "read:chapters"]
  }'
```

### Response (`200 OK`)
```json
{
  "client_id": "agent_lifetest_uk_pub",
  "access_token": "ltuk_agent_live_token_v1",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "read:tests read:chapters",
  "claim_uri": "https://lifetest.uk/api/agent/claim",
  "revocation_uri": "https://lifetest.uk/api/agent/revoke"
}
```

## 3. OAuth 2.0 & OIDC Discovery Metadata

- **OAuth 2.0 Protected Resource Metadata (RFC 9728)**: `https://lifetest.uk/.well-known/oauth-protected-resource`
- **OAuth 2.0 Authorization Server Metadata (RFC 8414)**: `https://lifetest.uk/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery 1.0**: `https://lifetest.uk/.well-known/openid-configuration`
- **JSON Web Key Set (JWKS)**: `https://lifetest.uk/.well-known/jwks.json`
- **Personal Agent Protocol (Poppy v0.1)**: `https://lifetest.uk/.well-known/poppy.json`