# auth.md — Agent Authentication & Registration (muratakar.com)

This document describes how AI agents can register, authenticate, and interact with the muratakar.com portfolio site according to the Auth.md specification (RFC 9420 / RFC 9728).

## Public Access (No Authentication Required)

The following resources are publicly accessible without any authentication:

- **Profile & Context:** `GET https://muratakar.com/llms.txt` — Machine-readable profile for AI models
- **Portfolio Content:** `GET https://muratakar.com/` with `Accept: text/markdown` header — Markdown-formatted portfolio
- **MCP Server Card:** `GET https://muratakar.com/.well-known/mcp/server-card.json` — MCP capabilities
- **Agent Skills:** `GET https://muratakar.com/.well-known/agent-skills/index.json` — Available skills
- **API Catalog:** `GET https://muratakar.com/.well-known/api-catalog` — API discovery
- **DNS-AID Discovery:** `GET https://muratakar.com/.well-known/dns-aid.json` — DNS-AID metadata

## DNS-Based Agent Discovery (DNS-AID)

Agents can discover agent endpoints via DNS ServiceMode (SVCB) records signed with DNSSEC:

- **Primary Index Record:** `_index._agents.muratakar.com` (SVCB 1 muratakar.com. alpn="h2,h3" port=443 mandatory=alpn,port)
- **A2A Endpoint Record:** `_a2a._agents.muratakar.com` (SVCB 1 muratakar.com. alpn="a2a" port=443 mandatory=alpn,port)
- **MCP Discovery Record:** `_mcp._agents.muratakar.com` (SVCB 1 muratakar.com. alpn="h2,h3" port=443 mandatory=alpn,port key65300="mcp")

## Agent Identity Registration & Standalone Specification

### Target Audience
AI Agents, Autonomous Assistants, and Machine-to-Machine Clients

### Registration Endpoint
`POST https://muratakar.com/auth/register`

### Supported Registration Methods
- Anonymous Identity Registration (`anonymous`)
- Identity Assertion (`urn:ietf:params:oauth:token-type:id-jag`, `verified_email`)
- HTTP Message Signatures (RFC 9421)
- Bearer Tokens (RFC 6750)

### Credential Usage & Authorization
Include `Authorization: Bearer <token>` or HTTP Signature headers on requests for authenticated endpoints.

### Registration URIs & Endpoints
- **Registration URI:** `https://muratakar.com/auth/register`
- **Claim URI:** `https://muratakar.com/auth/claim`
- **Revocation URI:** `https://muratakar.com/auth/revoke`
- **Supported Identity Types:** `anonymous`, `identity_assertion`
- **Supported Assertion Types:** `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
- **Supported Credential Types:** `none`, `http_signature`, `bearer_token`

### Option 1: User-Agent Header
Include a descriptive `User-Agent` header identifying your agent:
```
User-Agent: MyAgent/1.0 (agent-type/research; contact/agent@example.com)
```

### Option 2: HTTP Message Signatures (Recommended)
Use HTTP Message Signatures (RFC 9421) for cryptographically verified bot identity. Key discovery:
```
GET /.well-known/http-message-signatures-directory
```

## OAuth / OIDC Metadata Discovery

For agents requiring authenticated access to protected resources:

- **OAuth Authorization Server:** `https://muratakar.com/.well-known/oauth-authorization-server`
- **OpenID Configuration:** `https://muratakar.com/.well-known/openid-configuration`
- **Protected Resource Metadata:** `https://muratakar.com/.well-known/oauth-protected-resource`

## Content Signals

This site declares the following content usage preferences:

- `ai-train=no` — Content may **not** be used for AI model training
- `search=yes` — Content **may** be indexed for search
- `ai-input=yes` — Content **may** be used as agent context/input

## Contact

For agent-specific integration queries: **info@muratakar.com**

Portfolio: [https://muratakar.com](https://muratakar.com)