# auth.md — agent authorisation for Baan Talay Demo Resort

```json
{
  "agent_auth": {
    "skill": "https://agr-next.justar.dev/auth.md",
    "register_uri": "https://agr-next.justar.dev/oauth/register",
    "identity_endpoint": "https://agr-next.justar.dev/oauth/register",
    "claim_endpoint": "https://agr-next.justar.dev/oauth/token",
    "claim_uri": "https://agr-next.justar.dev/oauth/authorize",
    "identity_types_supported": [
      "anonymous"
    ],
    "anonymous": {
      "credential_types_supported": [
        "oauth2_access_token"
      ],
      "claim_uri": "https://agr-next.justar.dev/oauth/authorize"
    },
    "events_supported": []
  }
}
```

Most tools on this MCP server are public and need no token: `list_room_types`,
`search_rooms`, `get_room_details`, `get_room_photos`, `get_booking_link`.

One tool is protected. `send_enquiry` is the write path to the property, so it
requires an access token with scope `enquiry:write`.

**On this reference server it has no side effect.** It stores nothing, sends no
mail, and returns a synthetic reference number. Exercise the whole authorisation
flow end to end — that is what it is here for. A production deployment of this
layer wires the same tool to a real inbox, and there the write is real.

## Registering

Dynamic client registration (RFC 7591) is open — no pre-approval:

    POST https://agr-next.justar.dev/oauth/register
    Content-Type: application/json

    { "client_name": "Your agent", "redirect_uris": ["https://your.app/callback"] }

The returned `client_id` is self-describing and never expires.

## Getting a token

Authorization code flow with PKCE (S256 required):

1. `GET https://agr-next.justar.dev/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&scope=enquiry:write&code_challenge=...&code_challenge_method=S256`
2. `POST https://agr-next.justar.dev/oauth/token` with `grant_type=authorization_code`, `code`,
   `code_verifier`, `client_id`, `redirect_uri`

Access tokens last 3600 seconds. There are no refresh tokens —
repeat the flow.

## Discovery

- Protected resource metadata: https://agr-next.justar.dev/.well-known/oauth-protected-resource
- Authorization server metadata: https://agr-next.justar.dev/.well-known/oauth-authorization-server