# auth.md — Cicerone Agent Authentication & Registration

Cicerone serves public read-only venue discovery (`GET /`, `GET /<slug>`, `GET /api/venues`) without requiring credentials, and publishes OAuth 2.0 / Auth.md discovery metadata for agents submitting booking requests or staged owner update proposals.

## Discovery Endpoints
- Protected Resource Metadata (RFC 9728): `https://cicerone.quest-platform.com/.well-known/oauth-protected-resource`
- Authorization Server Metadata (RFC 8414): `https://cicerone.quest-platform.com/.well-known/oauth-authorization-server`
- OpenID Configuration: `https://cicerone.quest-platform.com/.well-known/openid-configuration`
- JWKS Directory: `https://cicerone.quest-platform.com/.well-known/http-message-signatures-directory`

## Supported Agent Registration Methods
- **Anonymous registration** (`anonymous`): agents can register a temporary session credential via `POST https://cicerone.quest-platform.com/agent/auth/register` and claim it via `https://cicerone.quest-platform.com/agent/auth/claim`.
- **Identity assertion** (`identity_assertion`): supports `urn:ietf:params:oauth:token-type:id-jag` and `verified_email` assertions, issuing scoped `bearer_token` credentials revocable at `https://cicerone.quest-platform.com/oauth/revoke`.

## Scopes
- `venues:read` — Read verified winery and restaurant catalogs
- `bookings:write` — Submit booking requests to the owner WhatsApp relay
- `owner:propose` — Stage owner update previews for button confirmation