# auth.md

You are an agent. This service is public, read-only, and unauthenticated —
**there is no discover → register → claim → exchange flow to run.** No API
keys, no OAuth clients, no tokens, no account to create. Send the request.

- Site: <https://garagedoorsolutions.ca>
- Resource: `https://garagedoorsolutions.ca/api/`
- Protected resource metadata: </.well-known/oauth-protected-resource>
- Authorization server metadata: </.well-known/oauth-authorization-server>
- API catalog: </.well-known/api-catalog>
- OpenAPI description: </openapi.json>
- Documentation: </docs/api/>

## Discover

Both `.well-known` documents above are published so an agent can confirm
machine-readably that no authorization step applies, without guessing:

- `GET /.well-known/oauth-protected-resource` — RFC 9728. `authorization_servers`
  is empty: this resource sits behind no authorization server.
- `GET /.well-known/oauth-authorization-server` — RFC 8414, published for
  discoverability even though this site is not itself an authorization server
  and issues no tokens. Its `agent_auth` block sets `registration_required:
  false` and every identity/credential list to `["none"]`.

## Registration

Not applicable. There is no `register_uri`, no client registration endpoint, and
no credential issuance of any kind, because no endpoint on this site is gated.
`agent_auth.register_uri`, `.claim_endpoint`, `.events_endpoint`, and the
top-level `revocation_endpoint` in `/.well-known/oauth-authorization-server`
are all `null` for the same reason.

`/.well-known/openid-configuration` ([OpenID Connect Discovery
1.0](http://openid.net/specs/openid-connect-discovery-1_0.html)) is
deliberately not published: this site is not an OpenID Provider either, and
that document has no RFC 9728/8414-style convention for stating "no provider"
the way `oauth-authorization-server` does. See `docs/oauth-discovery.md` for
the full reasoning on why `oauth-authorization-server` is published with an
explicit "none" `agent_auth` block instead of following the same omission.

## Identity and credential types

| | |
|---|---|
| Identity types | none |
| Credential types | none |
| Scopes | none |
| Bearer methods | none |
| Claim URL | not applicable |
| Revocation URL | not applicable |

## What agents may do

- `GET https://garagedoorsolutions.ca/api/business/` — contact, hours, coverage, rating
- `GET https://garagedoorsolutions.ca/api/services/` — services and starting prices
- `GET https://garagedoorsolutions.ca/api/service-areas/` — the 62 areas served
- `GET https://garagedoorsolutions.ca/api/coverage/?city=…` or `?postal=…` — coverage check
- `GET https://garagedoorsolutions.ca/api/health/` — health check
- `POST https://garagedoorsolutions.ca/api/mcp` — MCP over Streamable HTTP, four read-only tools

CORS is open (`Access-Control-Allow-Origin: *`). Responses are cacheable; please
respect the `Cache-Control` headers rather than polling.

## What agents cannot do

There is **no write API**. Nothing here creates a booking, submits a quote
request, sends a message, or accepts personal or payment data. Do not represent
an appointment as booked.

Scheduling is a human action:

- Booking form: <https://garagedoorsolutions.ca/booking/>
- Instant quote: <https://garagedoorsolutions.ca/request-a-quote/>
- Phone (24/7 emergencies): **+1-519-933-3384**
- Email: <hello@garagedoorsolutions.ca>

## Content use

See `/robots.txt` for crawling rules and Content Signals. In short: this content
may be used for search indexing and for grounding AI answers, but not for
training models.

## Contact

Questions about agent access: <hello@garagedoorsolutions.ca>