# auth.md

## Vimal Gandhi Agent Auth Instructions

Public website pages are available without authentication. This file is also mirrored at /.well-known/auth.md.

## Contact API

- Endpoint: https://vimal-gandhi.vercel.app/api/contact
- Authentication: none
- Intended use: project inquiries submitted with explicit user intent
- Rate limit: 5 requests per 60 seconds per IP

## Agent Registration

This site supports discovery-only agent registration metadata. Public browsing does not require registration, and this portfolio does not currently issue OAuth access tokens to agents.

### Registration Endpoints

- skill: https://vimal-gandhi.vercel.app/auth.md
- register_uri: https://vimal-gandhi.vercel.app/auth.md
- identity_endpoint: https://vimal-gandhi.vercel.app/agent/identity
- claim_endpoint: https://vimal-gandhi.vercel.app/agent/identity/claim
- events_endpoint: https://vimal-gandhi.vercel.app/agent/event/notify
- OAuth protected resource metadata: https://vimal-gandhi.vercel.app/.well-known/oauth-protected-resource
- OAuth authorization server metadata: https://vimal-gandhi.vercel.app/.well-known/oauth-authorization-server
### agent_auth metadata

The authorization-server metadata includes this machine-readable registration block:

```json
{
  "agent_auth": {
    "skill": "https://vimal-gandhi.vercel.app/auth.md",
    "register_uri": "https://vimal-gandhi.vercel.app/auth.md",
    "identity_types_supported": [
      "anonymous",
      "service_auth",
      "web-bot-auth",
      "user-confirmed-contact"
    ],
    "credential_types_supported": [
      "none",
      "http-message-signature",
      "user-confirmed-contact"
    ],
    "anonymous": {
      "credential_types_supported": [
        "none"
      ]
    },
    "claim_uri": "https://vimal-gandhi.vercel.app/agent/identity/claim",
    "revocation_uri": "https://vimal-gandhi.vercel.app/agent/event/notify"
  }
}
```
- ACP discovery: https://vimal-gandhi.vercel.app/.well-known/acp.json
- claim_uri: https://vimal-gandhi.vercel.app/agent/identity/claim
- revocation_uri: https://vimal-gandhi.vercel.app/agent/event/notify

### Supported Identity Types

- anonymous: allowed for reading public pages.
- service_auth: accepted only as a discovery signal; no credentials are issued.
- web-bot-auth: supported for bot identity via HTTP Message Signatures.
- user-confirmed-contact: required before an agent submits the contact form.

### Credential Types

- none: public browsing and discovery files.
- http-message-signature: verified bot identity through Web Bot Auth.
- user-confirmed-contact: contact form intent confirmed by the human user.

### Registration Flow

1. Fetch this file at /auth.md.
2. Fetch /.well-known/oauth-protected-resource.
3. Fetch /.well-known/oauth-authorization-server and read the agent_auth block.
4. Use public pages and discovery endpoints without credentials.
5. Ask the human user for approval before submitting /api/contact.
6. Do not expect an access token because this portfolio does not expose protected agent APIs.

Web Bot Auth public key directory: https://vimal-gandhi.vercel.app/.well-known/http-message-signatures-directory

Agents must not submit automated sales outreach, spam, vulnerability probes, or test data through the contact API.

## DNS AI Discovery

DNS AI discovery requires a custom domain that you control. If you connect one, add SVCB records in that domain's DNS provider:

- _index._agents.<your-domain>. 3600 IN SVCB 1 <your-domain>. alpn="h2,http/1.1" port=443 mandatory=alpn,port cap="https://vimal-gandhi.vercel.app/.well-known/agent-skills/index.json"
- _mcp._agents.<your-domain>. 3600 IN SVCB 1 <your-domain>. alpn="h2,http/1.1" port=443 mandatory=alpn,port cap="https://vimal-gandhi.vercel.app/.well-known/mcp/server-card.json"

The vercel.app subdomain is controlled by Vercel, so publish DNS-AID records on your own custom domain.

## Web Bot Auth

- Key directory: https://vimal-gandhi.vercel.app/.well-known/http-message-signatures-directory
- Environment variables: WEB_BOT_AUTH_PRIVATE_KEY for signing and WEB_BOT_AUTH_PUBLIC_JWK for publishing the public JWKS when signing is handled elsewhere
- Generate a key with: npm run web-bot-auth:key