# auth.md

You are an agent. **Lummo** (`https://lummo.ar`) publishes Auth.md and OAuth discovery for its public marketing/API surface. Follow the steps in order.

- Resource server: `https://lummo.ar`
- Authorization server: `https://lummo.ar` (same origin)
- Tenant ERP (authenticated obras, materials, purchasing): `https://app.lummo.ar` — see `https://app.lummo.ar/auth.md`

> **Status:** Discovery documents are published. **Anonymous** self-serve credentials are enabled via `POST /agent/auth` (`{"type":"anonymous"}`) and `POST /api/v1/keys`. Identity-assertion / verified-email issuance remains `*_not_enabled`. Public landing APIs (`/api/v1/*`) also work **without** Bearer tokens (zero-auth). Do not probe identity_assertion during passive scans.

## 1. Discover

On `401 Unauthorized`, read the discovery pointer:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://lummo.ar/.well-known/oauth-protected-resource"
```

If you do not have a 401, fetch:

```http
GET https://lummo.ar/.well-known/oauth-protected-resource
```

### Protected Resource Metadata

Expect `resource`, `resource_name`, `authorization_servers`, `scopes_supported`, and `bearer_methods_supported` (`header`).

### Authorization Server metadata

```http
GET https://lummo.ar/.well-known/oauth-authorization-server
```

Also available as OpenID Connect discovery:

```http
GET https://lummo.ar/.well-known/openid-configuration
```

Read `issuer`, `token_endpoint`, `jwks_uri`, `grant_types_supported`, and the `agent_auth` block (`skill`, `register_uri`, `claim_uri`, `revocation_uri`, identity types).

`issuer` must match the authorization server advertised in PRM (`https://lummo.ar`).

## 2. Pick a method

1. Prefer **zero-auth** for public landing APIs (`/api/v1/health`, sandbox, newsletter, Lummito)
2. Or mint a free key: `POST https://lummo.ar/api/v1/keys` or `POST https://lummo.ar/agent/auth` with `{"type":"anonymous"}`
3. Audience-bound ID-JAG → `identity_assertion` + `urn:ietf:params:oauth:token-type:id-jag` (not enabled yet)
4. Verified email → `identity_assertion` + `verified_email` (not enabled yet)

## 3. Register

```http
POST https://lummo.ar/agent/auth
Content-Type: application/json

{"type":"anonymous","label":"my-agent"}
```

Expect `201` with `access_token` (free tier). For identity_assertion / verified_email, expect `*_not_enabled`.

For **ERP tenant** agent registration, use `https://app.lummo.ar/auth.md` instead.

## 4. Credentials (optional)

```http
Authorization: Bearer <access_token>
```

Public landing endpoints also accept unauthenticated calls.

## 5. Human fallback

- Product signup / free trial: `https://app.lummo.ar/comenzar`
- ERP login: `https://app.lummo.ar/login`
- Contact: contacto@lummo.ar

## 6. Related discovery

- API catalog: `https://lummo.ar/.well-known/api-catalog`
- OpenAPI: `https://lummo.ar/openapi.json`
- Lummo API docs: `https://lummo.ar/lummo-api`
- MCP manifest: `https://lummo.ar/.well-known/mcp.json`
- MCP server card: `https://lummo.ar/.well-known/mcp/server-card.json`
- ARD catalog: `https://lummo.ar/.well-known/ai-catalog.json`
- Agent skills: `https://lummo.ar/.well-known/agent-skills/index.json`