# auth.md

You are an agent. This document describes **agent registration** for Kunying Civil Engineering (บริษัท คุณหญิง.ธุรกิจ การโยธา จำกัด).

**There is no user login.** This is an offline demolition contractor in Bangkok. Humans hire the crew by phone or LINE. There is no booking API, payment API, password, or account to claim. The OAuth discovery files exist so agents can find that fact instead of guessing.

## Step 1 — Discover

```http
GET /.well-known/oauth-protected-resource
GET /.well-known/oauth-authorization-server
```

What those documents mean here:

- `resource`: `https://kunying-civil.com/`
- `authorization_servers`: `https://kunying-civil.com` (this origin — not a separate IdP)
- `scopes_supported`: `company:read` (public company facts)
- `bearer_methods_supported`: `header` (unused — no bearer token is issued)
- `grant_types_supported`: `none`
- `response_types_supported`: `none`
- `agent_auth.skill`: this file
- `agent_auth.register_uri`: `https://kunying-civil.com/agent/register`
- `agent_auth.identity_types_supported`: `anonymous`
- `agent_auth.anonymous.credential_types_supported`: `none`
- `agent_auth.anonymous.claim_uri`: `https://kunying-civil.com/contact` (a human contact page, not a claim ceremony)

`/.well-known/openid-configuration` repeats the same metadata for clients that only look there. This site is **not** an OpenID Provider and does not mint ID tokens.

`jwks_uri` is `/.well-known/jwks.json`, the same public key as Web Bot Auth. It is **not** used to sign access tokens, because none are issued.

## Step 2 — Pick a method

Only **anonymous** is supported, and it issues **no credential**.

- Do not open `/oauth/authorize` expecting a login form. That URL returns JSON saying login is false.
- Do not POST `/oauth/token` expecting `access_token`. It returns `unsupported_grant_type`.
- Do not mint an ID-JAG or send `identity_assertion`.
- Do not start a verified-email / user-claimed ceremony. There is no user account.

## Step 3 — Register

`register_uri` is advertised so agents have a registration endpoint to probe. Calling it does **not** create a client, store a record, or issue a token.

```http
GET /agent/register
POST /agent/register
Content-Type: application/json

{ "type": "anonymous" }
```

Response:

```json
{
  "registration_type": "anonymous",
  "credential_types_supported": ["none"],
  "stored": false,
  "issues_tokens": false
}
```

Then read the public APIs. That is the whole flow.

## Step 4 — Claim

There is no claim ceremony. `claim_uri` is the public contact page so a **human** can request a demolition quote. Do not poll a device code. Do not create an account on behalf of a user.

## Step 5 — Use the APIs (no credential)

- `GET https://kunying-civil.com/api/company`
- `GET https://kunying-civil.com/api/health`
- `GET https://kunying-civil.com/api/openapi.json`
- `POST https://kunying-civil.com/mcp` (`get_company_info`, `get_services`, `get_contact`)
- `GET https://kunying-civil.com/llms.txt`
- HTML pages also negotiate `Accept: text/markdown`

## How a human gets a quote

1. Call **091-770-4447** or **081-100-6629**
2. Or chat via LINE: https://line.me/ti/p/Vz_kX4GYVM
3. Or email thidarat.pa@ku.th
4. Or open https://kunying-civil.com/contact

## Errors

| Code | Where | What to do |
| --- | --- | --- |
| `unsupported_grant_type` | `POST /oauth/token` | Expected. No token is issued. Call the public APIs. |
| `anonymous_only` | `POST /agent/register` | Use `{ "type": "anonymous" }` or skip registration. |
| `method_not_allowed` | `GET /mcp` | Use `POST /mcp`. |

## Identity

- Site: https://kunying-civil.com
- Legal name: บริษัท คุณหญิง.ธุรกิจ การโยธา จำกัด
- Address: 133/3 ซอยเพิ่มสิน 20 แยก 5-5 แขวงคลองถนน เขตสายไหม กรุงเทพมหานคร 10220