# Auth.md

Fynexio publishes a real OAuth 2.0 and OpenID Connect authorization server for read-only public AI access.

## Supported flows

- Authorization Code with PKCE (`S256`) for seller-authorized public AI access.
- Refresh Token for previously authorized confidential clients.
- Client Credentials for confidential read-only machine clients.

## OAuth endpoints

- Authorization endpoint: `https://fynexio.com/oauth/authorize`
- Token endpoint: `https://fynexio.com/oauth/token`
- Dynamic client registration: `https://fynexio.com/oauth/register`
- Revocation endpoint: `https://fynexio.com/oauth/revoke`
- Authorization server metadata: `https://fynexio.com/.well-known/oauth-authorization-server`
- OpenID configuration: `https://fynexio.com/.well-known/openid-configuration`
- JWKS: `https://fynexio.com/.well-known/jwks.json`

## Resource metadata

- Protected resource metadata: `https://fynexio.com/.well-known/oauth-protected-resource`
- Agent API resource: `https://fynexio.com/api/agent`
- MCP resource: `https://fynexio.com/mcp`
- A2A resource: `https://fynexio.com/a2a`

## Agent registration discovery

- The authorization server metadata publishes an `agent_auth` block.
- `agent_auth.skill` points to `https://fynexio.com/auth.md`.
- `agent_auth.register_uri` and `agent_auth.identity_endpoint` both point to `https://fynexio.com/oauth/register` for OAuth client registration.
- `agent_auth.claim_uri` and `agent_auth.claim_endpoint` both point to `https://fynexio.com/oauth/authorize` for the seller approval step.
- `agent_auth.revocation_uri` points to `https://fynexio.com/oauth/revoke`.
- `agent_auth.identity_types_supported` is `anonymous` because client registration itself does not require a pre-existing identity assertion.
- After registration, use the OAuth authorization endpoint for seller-approved access or the token endpoint for confidential client credentials access.

## Supported scopes

- `docs.read`: Read Fynexio public documentation and discovery content.
- `status.read`: Read public Fynexio service and availability information.
- `mcp.read`: Access the Fynexio public MCP tool surface.
- `a2a.read`: Access the Fynexio public A2A agent surface.
- `openid`: Request an ID token for the authenticated seller account.
- `profile`: Read basic seller profile claims in the ID token.
- `email`: Read seller email claims in the ID token.

## Client registration rules

- `authorization_code` clients must pre-register every redirect URI.
- `client_credentials` requires a confidential client with a client secret.
- `token_endpoint_auth_method=none` is supported for public PKCE clients, but not for client credentials.
- HTTPS redirect URIs are required except for loopback development redirects on `localhost` or `127.0.0.1`.

## Token behavior

- Access tokens are signed as `RS256` JWTs and published through the JWKS endpoint.
- Access tokens expire after 3600 seconds.
- Refresh tokens expire after 30 days and rotate on use.
- Revocation is available through the standard revocation endpoint.

## OpenID Connect

- `openid` can be requested with the authorization code flow.
- `profile` and `email` add claims to the returned ID token when requested.
- `nonce` is required whenever `openid` is requested.

## Public discovery links

- Homepage: `https://fynexio.com/`
- Public API guide: `https://fynexio.com/public-api.md`
- OpenAPI document: `https://fynexio.com/openapi-public.json`
- MCP server card: `https://fynexio.com/.well-known/mcp/server-card.json`
- A2A agent card: `https://fynexio.com/.well-known/agent-card.json`

## Contact

- Compliance and security contact: `compliance@fynexio.com`