# auth.md — Marketing Digital Online Agent Authentication & Registration

You are an AI agent. This service supports **agentic registration** and authentication per the [Auth.md](https://workos.com/auth-md) specification and OAuth 2.0 Protected Resource Metadata ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9727)).

## Audience & Purpose
This document provides automated discovery and instructions for AI agents (LLMs, autonomous assistants, MCP clients) wishing to authenticate, register, and interact with the **Marketing Digital Online** APIs and services on behalf of users.

## Discovery Metadata
The service publishes discovery documents at the following well-known locations:
- **Protected Resource Metadata (PRM)**: `/.well-known/oauth-protected-resource`
- **Authorization Server Metadata**: `/.well-known/oauth-authorization-server`
- **API Catalog**: `/.well-known/api-catalog`
- **Agent Skill & Auth Guide**: `/auth.md`

## Supported Identity Types & Registration Flows

The authorization server supports the following registration flows defined in the `agent_auth` metadata block:

### 1. Anonymous Registration (`anonymous`)
- **Use case**: Agents performing read-only queries, status checks, or public requests without prior user credentials.
- **Registration endpoint**: `POST https://marketingdigitalonline.com.es/agent/auth`
- **Credential type**: `bearer_token`
- **Claiming flow**: Anonymous sessions can be elevated to authenticated user accounts via `claim_uri`: `https://marketingdigitalonline.com.es/agent/claim`

### 2. Identity Assertion (`identity_assertion`)
- **Use case**: Agents acting on behalf of verified users with identity assertions issued by trusted agent providers (e.g. OpenAI, Anthropic, Cursor, WorkOS).
- **Supported Assertion Types**:
  - `urn:ietf:params:oauth:token-type:id-jag` (Identity-JSON Assertion Graph)
  - `verified_email` (Signed email identity assertion)
- **Registration endpoint**: `POST https://marketingdigitalonline.com.es/agent/auth`
- **Claim / Verification URI**: `https://marketingdigitalonline.com.es/agent/claim`
- **Credential type**: `bearer_token`

### 3. Revocation & Lifecycle
- **Revocation endpoint**: `POST https://marketingdigitalonline.com.es/agent/revoke`
- **Supported Events**: `https://schemas.workos.com/events/agent/auth/identity/assertion/revoked`

## How to Authenticate API Requests
Once issued, include your access token in all API requests via the standard HTTP `Authorization` header:

```http
GET /api/health HTTP/1.1
Host: marketingdigitalonline.com.es
Authorization: Bearer <your_access_token>
```

## Scopes Supported
- `read`: Read public site data, service catalogs, and status information.
- `write`: Submit contact inquiries, quotes, or interact with customer workflows.