# auth.md

Authentication and authorization guidance for AI agents interacting with EduVivo.

## Service Information

- **Resource Server:** `https://eduvivo.net`
- **Authorization Server:** `https://eduvivo.net`
- **Protected Resource Metadata (RFC 9728):** `https://eduvivo.net/.well-known/oauth-protected-resource`
- **OAuth Authorization Server Metadata (RFC 8414):** `https://eduvivo.net/.well-known/oauth-authorization-server`
- **OpenID Connect Configuration:** `https://eduvivo.net/.well-known/openid-configuration`
- **API Catalog (RFC 9727):** `https://eduvivo.net/.well-known/api-catalog`

---

## Step 1: Discovery

Fetch the Protected Resource Metadata (PRM) to discover the authorization server and supported scopes:

```http
GET /.well-known/oauth-protected-resource HTTP/1.1
Host: eduvivo.net
Accept: application/json
```

---

## Step 2: Supported Registration & Authentication Flows

### 1. Agent-Verified Flow (ID-JAG)
Trusted external agents (e.g. OpenAI, Anthropic, Cloudflare Agents) presenting an Identity Assertion JWT (ID-JAG):
- **Assertion Endpoint:** `https://eduvivo.net/api/auth/agent-identity`
- **Token Type:** Bearer JWT

### 2. User-Claimed OAuth 2.0 Flow
When an agent acts on behalf of an end-user:
1. Direct the user to the Authorization Endpoint:
   `https://eduvivo.net/login?response_type=code&client_id={agent_client_id}&scope=openid+profile+email+student:enroll`
2. Exchange the returned authorization code at the Token Endpoint:
   `https://eduvivo.net/api/auth/token`

---

## Step 3: Available Scopes & Endpoints

| Scope | Type | Description |
|---|---|---|
| `read:courses` | Public / Open | Discover courses, categories, and public pricing without credentials |
| `student:read` | Protected | Access user profile, enrolled courses, and learning progress |
| `student:enroll` | Protected | Initiate course registration and checkout on behalf of user |
| `offline_access` | Protected | Request a refresh token for long-running workflows |

---

## Policies & Contact

- **Terms of Service:** `https://eduvivo.net/policies/terms`
- **Privacy Policy:** `https://eduvivo.net/policies/privacy`
- **Security & Support:** `security@eduvivo.net`