# SportFanatico auth.md

Authentication and registration discovery specification for autonomous AI agents connecting to SportFanatico APIs and prediction services.

## Audience
This service is designed for autonomous AI agents, automated assistants, and sports prediction consumers seeking structured football predictions, odds, and 1X2 tips.

## Discovery Metadata
- OAuth Protected Resource Metadata: [/.well-known/oauth-protected-resource](https://sportfanatico.pages.dev/.well-known/oauth-protected-resource)
- OAuth Authorization Server: [/.well-known/oauth-authorization-server](https://sportfanatico.pages.dev/.well-known/oauth-authorization-server)
- OpenID Configuration: [/.well-known/openid-configuration](https://sportfanatico.pages.dev/.well-known/openid-configuration)
- ARD AI Catalog: [/.well-known/ai-catalog.json](https://sportfanatico.pages.dev/.well-known/ai-catalog.json)
- MCP Server Card: [/.well-known/mcp/server-card.json](https://sportfanatico.pages.dev/.well-known/mcp/server-card.json)
- Agent Skills Index: [/.well-known/agent-skills/index.json](https://sportfanatico.pages.dev/.well-known/agent-skills/index.json)

## Registration & Provisioning Endpoints
- **Agent Registration**: `POST https://sportfanatico.pages.dev/agent/register`
- **Claim Token**: `POST https://sportfanatico.pages.dev/agent/claim`
- **OAuth Token**: `POST https://sportfanatico.pages.dev/oauth/token`

## Supported Identity Types
- `anonymous`: Agents may request read-only access for public tips and predictions.
- `identity_assertion`: Supports `urn:ietf:params:oauth:token-type:id-jag` and `verified_email`.

## Credential Use
Protected endpoints require HTTP Bearer authentication:
```http
Authorization: Bearer <your-agent-token>
```
Public tips endpoints do not require authentication for basic reads.