# auth.md

You are an agent. This service (Teal Packaging) supports **agentic registration**: discover -> register -> (claim if needed) -> exchange for an access_token -> call API -> handle revocation. Follow the steps in order; do not skip ahead.

Most surfaces are public and need no auth: `/mcp` (MCP tools), product feeds, `llms.txt`, `agents.md`, and Markdown content negotiation. Only the Agentic Checkout API (`/acp/*`) requires a Bearer token. This service uses anonymous agent registration (no human user identity required) via OAuth 2.0 client_credentials.

## Step 1 - Discover

Two hops. The 401 from `/acp/*` carries a `WWW-Authenticate` header pointing to the Protected Resource Metadata.

### 1a. Protected Resource Metadata
```http
GET https://tealpackaging.com/.well-known/oauth-protected-resource
```
Tells you the `resource` (https://tealpackaging.com/acp), `authorization_servers`, `scopes_supported` (acp.checkout, quotes), and `bearer_methods_supported` (header).

### 1b. Authorization Server metadata
```http
GET https://tealpackaging.com/.well-known/oauth-authorization-server
```
Carries the `agent_auth` block: `identity_types_supported: ["anonymous"]`, `register_uri`, `claim_uri`, `token_endpoint`, and credential types.

## Step 2 - Register

Anonymous registration. No user consent or claim ceremony is required for this service - the register endpoint immediately issues credentials.
```http
POST https://tealpackaging.com/oauth/register
Content-Type: application/json

{"client_name": "your-agent-name", "contact_email": "you@example.com"}
```
Response returns `client_id` and `client_secret` (credential type: client_secret; shown once - store it).

## Step 3 - Exchange for an access_token

```http
POST https://tealpackaging.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET
```
Response: `{"access_token":"tk_...","token_type":"Bearer","expires_in":3600,"scope":"acp.checkout quotes"}`.

## Step 4 - Call the API

Send the token on every `/acp/*` request:
```http
POST https://tealpackaging.com/acp/checkout_sessions
Authorization: Bearer tk_...
```

## Step 5 - Handle revocation

Tokens expire after 1 hour (3600s); request a new one by repeating Step 3. To stop using a token early, discard it; contact https://tealpackaging.com/contact-us/ to revoke a client_id.

## Skill
Machine-readable skill: https://tealpackaging.com/skills/teal-packaging/SKILL.md