# Auth.md

OCLaunch agent registration for https://launch.orangecloud.vn.

## Audience

Agents reading public project passports, and agents helping a person who already has an OCLaunch passkey. OCLaunch does not create accounts or issue bearer tokens from this file.

## Protected resource

Fetch `/.well-known/oauth-protected-resource`.

- `resource` is `https://launch.orangecloud.vn/api`.
- `authorization_servers` lists `https://launch.orangecloud.vn`, the same issuer as `/.well-known/oauth-authorization-server`.
- `scopes_supported` includes `public:read`.
- `bearer_methods_supported` includes `header`. Public reads do not use that header. Workspace routes answer 401 with `WWW-Authenticate` pointing at the protected resource metadata, then still require a passkey session rather than a bearer token.

## Authorization server

Fetch `/.well-known/oauth-authorization-server` (the same fields are also at `/.well-known/openid-configuration`).

The `agent_auth` block contains:

- `skill`: this document
- `register_uri`: `https://launch.orangecloud.vn/agent/register`
- `identity_types_supported`: `anonymous`
- `anonymous.credential_types_supported`: `none`
- `anonymous.claim_uri`: `https://launch.orangecloud.vn/agent/claim`

`issuer` is `https://launch.orangecloud.vn`. `jwks_uri` publishes an empty key set because OCLaunch does not sign access tokens.

## Anonymous registration

`POST /agent/register` with `{"type":"anonymous"}`.

The response confirms credential type `none`. No account is created and no secret is returned. Call the public endpoints directly.

## Claim

`POST /agent/claim` repeats the public URLs an anonymous agent may call: `/api/health`, `/api/discover`, and `/p/{slug}`.

## Passkeys for the private workspace

A person creates a passkey at `/signin`. That session cookie is what `/api/projects`, reviews, improvements, and reports accept. `GET /oauth/authorize` and `POST /oauth/token` explain this and do not issue grants. There is no ID-JAG, verified-email, or anonymous secret flow.

## Revocation

The signed-in browser revokes its session with `POST /api/auth/logout`. There is no bearer token to revoke and no revocation URL for anonymous public access.