# auth.md — BOP.INK agent access

BOP.INK's public catalog, documentation, read-only APIs, WebMCP and MCP discovery remain available without login. Agents that need an explicit bearer identity may use BOP.INK's optional OAuth 2.0 authorization-code flow with PKCE.

## Discovery

- OAuth Authorization Server Metadata: `https://bop.ink/.well-known/oauth-authorization-server`
- OAuth Protected Resource Metadata: `https://bop.ink/.well-known/oauth-protected-resource`
- Public keys: `https://bop.ink/oauth/jwks`
- Registration: `https://bop.ink/agent/register`
- Authorization: `https://bop.ink/oauth/authorize`
- Token: `https://bop.ink/oauth/token`

## Access methods

Anonymous clients may use public discovery and MCP endpoints directly. OAuth clients register HTTPS or localhost redirect URIs, use authorization code with S256 PKCE, and send an issued bearer token in the `Authorization` header where an integration requires agent identity. OAuth never overrides capability runtime, consent, privacy, or freshness policy.

```yaml
agent_auth:
  skill: https://bop.ink/auth.md
  register_uri: https://bop.ink/agent/register
  methods:
    - type: oauth2_authorization_code_pkce
      metadata: https://bop.ink/.well-known/oauth-authorization-server
      registration: dynamic
      token_auth_method: none
    - type: anonymous
      endpoint: https://bop.ink/mcp
      credentials: none
```