---
agent_auth:
  skill: "https://www.jpsolutions.online/auth.md"
  register_uri: "https://www.jpsolutions.online/agent/identity"
  identity_endpoint: "https://www.jpsolutions.online/agent/identity"
  claim_uri: "https://www.jpsolutions.online/agent/identity/claim"
  claim_endpoint: "https://www.jpsolutions.online/agent/identity/claim"
  revocation_uri: "https://www.jpsolutions.online/oauth2/revoke"
  revocation_endpoint: "https://www.jpsolutions.online/oauth2/revoke"
  supported_identity_types:
    - "anonymous"
    - "identity_assertion"
    - "service_auth"
  identity_types_supported:
    - "anonymous"
    - "identity_assertion"
    - "service_auth"
  credential_types:
    - "oauth2_token"
    - "api_key"
  credential_types_supported:
    - "oauth2_token"
    - "api_key"
---

# auth.md

You are an agent. This service supports **agentic registration**: discover → register → (claim if needed) → exchange for an access_token → call API → handle revocation. Follow the steps in order; do not skip ahead.

Examples use host: `https://www.jpsolutions.online` (the resource server and authorization server).

## Step 1 — Discover

Discovery is two hops — you may have already done this.

The 401 response that pointed you here carries a `WWW-Authenticate` header with the PRM URL:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://www.jpsolutions.online/.well-known/oauth-protected-resource"
```

Pull the `resource_metadata` value from that header and fetch it (1a). The conventional path on the resource server is `/.well-known/oauth-protected-resource`.

### 1a. Fetch the Protected Resource Metadata

```http
GET /.well-known/oauth-protected-resource
```

Response shape:

```json
{
  "resource": "https://www.jpsolutions.online/",
  "resource_name": "JP Solutions",
  "resource_logo_uri": "https://www.jpsolutions.online/logo2.jpg",
  "authorization_servers": ["https://www.jpsolutions.online/"],
  "scopes_supported": ["read:services", "write:contact", "read:company_info"],
  "bearer_methods_supported": ["header"]
}
```

### 1b. Fetch the Authorization Server metadata

```http
GET /.well-known/oauth-authorization-server
```

Response shape:

```json
{
  "resource": "https://www.jpsolutions.online/",
  "authorization_servers": ["https://www.jpsolutions.online/"],
  "scopes_supported": ["read:services", "write:contact", "read:company_info"],
  "bearer_methods_supported": ["header"],
  "issuer": "https://www.jpsolutions.online",
  "token_endpoint": "https://www.jpsolutions.online/oauth2/token",
  "revocation_endpoint": "https://www.jpsolutions.online/oauth2/revoke",
  "grant_types_supported": [
    "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "urn:workos:agent-auth:grant-type:claim"
  ],
  "agent_auth": {
    "skill": "https://www.jpsolutions.online/auth.md",
    "register_uri": "https://www.jpsolutions.online/agent/identity",
    "identity_endpoint": "https://www.jpsolutions.online/agent/identity",
    "claim_uri": "https://www.jpsolutions.online/agent/identity/claim",
    "claim_endpoint": "https://www.jpsolutions.online/agent/identity/claim",
    "revocation_uri": "https://www.jpsolutions.online/oauth2/revoke",
    "revocation_endpoint": "https://www.jpsolutions.online/oauth2/revoke",
    "supported_identity_types": ["anonymous", "identity_assertion", "service_auth"],
    "identity_types_supported": ["anonymous", "identity_assertion", "service_auth"],
    "credential_types": ["oauth2_token", "api_key"],
    "credential_types_supported": ["oauth2_token", "api_key"]
  }
}
```

## Step 2 — Pick a method

1. **`identity_assertion + id-jag`**: Exchange user identity session for an ID-JAG token.
2. **`service_auth`**: Use corporate email identity.
3. **`anonymous`**: Query public services, documentation and contact forms.

## Step 3 — Register

Send registration payload to `https://www.jpsolutions.online/agent/identity` or submit client inquiry at `https://www.jpsolutions.online/#contacto`.

## Step 4 — Revocation

To revoke access tokens POST to `https://www.jpsolutions.online/oauth2/revoke`.