# AIpplied Labs auth.md

Instructions for AI agents that call the AIpplied Labs endpoints.

## Do you need a token?

No. Every endpoint on www.aippliedlabs.com is public and works without credentials:

- `POST /mcp`: MCP server (Streamable HTTP)
- `POST /a2a`: A2A agent (JSON-RPC)
- `POST /api/ask` and `POST /api/check`: JSON endpoints, described in [/openapi.json](/openapi.json)

Anonymous callers share a rate limit per IP address, so agents running on shared cloud infrastructure can run into each other's limits. A token gives your agent its own limit. That's the only thing a token changes.

## Audience

Any AI agent acting for a person who wants to learn about AIpplied Labs, get a question answered, or find which of its systems fits a business. There are no user accounts, so there's nothing to claim and no email to verify.

## Supported method

| Identity type | Credential | Claim ceremony |
|---|---|---|
| `anonymous` | `access_token` (Bearer JWT, one hour) | None |

## Steps

1. **Discover.** Read [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource), then the authorization server metadata at [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server). Its `agent_auth` block names the registration endpoint.

2. **Register.** Request an anonymous identity:

   ```http
   POST /agent/identity
   Content-Type: application/json

   {"type": "anonymous"}
   ```

   The response contains an `identity_assertion` that is valid for ten minutes, and your `agent_id`.

3. **Exchange.** Trade the assertion for an access token with the RFC 7523 JWT-bearer grant:

   ```http
   POST /oauth2/token
   Content-Type: application/x-www-form-urlencoded

   grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<identity_assertion>
   ```

   The response contains `access_token`, `token_type: Bearer`, `expires_in: 3600`, and `scope: faq.ask week.check`.

4. **Use.** Send `Authorization: Bearer <access_token>` to `/mcp`, `/a2a`, `/api/ask`, or `/api/check`.

5. **Renew.** When the token expires, repeat steps 2 and 3. There are no refresh tokens.

## Rules

- An invalid or expired token isn't rejected. The request runs anonymously.
- Tokens are signed with ES256. The public key is at [/.well-known/jwks.json](/.well-known/jwks.json).
- Each IP address can register at most three identities every ten minutes. Past that, registration returns `429 slow_down`. Keep your `agent_id` and its token for the whole hour instead of registering again.
- If registration returns `503 temporarily_unavailable`, keep going without a token.
- Don't submit the site's contact form on a person's behalf without their explicit go-ahead. The `how_to_book` tool explains how a person books a session.