# auth.md, Brandry

## Summary

**All READ access to this site is open.** Every page, every data file and every read tool on
the MCP endpoint can be fetched and called anonymously over HTTPS with no credential, no
sign-up and no rate-limit key. If you only want to read about Brandry, stop here and go to
https://brandry.ai/agents.md.

A single **partner API** at `https://brandry.ai/api/ucp/partner` is protected by a real
OAuth 2.0 authorization server using the **client_credentials** grant. It exists for
provisioned reseller and platform partners. It is not needed for anything an ordinary
research or shopping agent does.

## Agent audience

The intended audience is autonomous AI agents and assistants (Claude, ChatGPT, Cursor,
Claude Code and other MCP clients) reading about Brandry's product, pricing and modules on
behalf of a dealer, an agency, a partner or a journalist, plus provisioned partner clients
calling the partner API.

## OAuth metadata (real)

- **Protected Resource Metadata (RFC 9728):** `https://brandry.ai/.well-known/oauth-protected-resource/api/ucp/partner`
- **Authorization Server Metadata (RFC 8414):** `https://brandry.ai/.well-known/oauth-authorization-server`
- **Issuer:** `https://brandry.ai`
- **Token endpoint:** `https://brandry.ai/oauth/token` (grant `client_credentials`)
- **JWKS:** `https://brandry.ai/oauth/jwks` (ES256, published `kid`)
- **Protected resource:** `https://brandry.ai/api/ucp/partner`, scope `partner:read`, bearer token in the `Authorization` header.

A request to the partner API with no token, or an invalid one, returns **HTTP 401** with
`WWW-Authenticate: Bearer resource_metadata="https://brandry.ai/.well-known/oauth-protected-resource/api/ucp/partner"`.

This authorization server supports **only** the `client_credentials` grant. It has no
interactive authorization step, so `/oauth/authorize` exists for discovery completeness and
truthfully rejects interactive attempts with `unsupported_response_type` per RFC 6749.

## Registration and provisioning

- **Reads: anonymous (none).** No sign-up, no provisioning, no credential. Connect directly.
- **Partner API: client_credentials.** Client credentials (`client_id` + `client_secret`) are
  issued **out-of-band** to approved reseller and platform partners. There is no public
  self-service registration and no Dynamic Client Registration. To be provisioned, email
  hello@brandry.ai.

```json
{
  "agent_auth": {
    "skill": "https://brandry.ai/auth.md",
    "register_uri": "https://brandry.ai/auth.md",
    "identity_types_supported": ["anonymous"],
    "anonymous": { "credential_types_supported": ["none"] },
    "claim_uri": "https://brandry.ai/.well-known/oauth-protected-resource/api/ucp/partner",
    "registration_methods": [
      {
        "identity_types_supported": ["anonymous"],
        "anonymous": { "credential_types_supported": ["none"] },
        "claim_uri": "https://brandry.ai/.well-known/oauth-protected-resource/api/ucp/partner",
        "description": "All read tools and data endpoints require no credential; connect anonymously over HTTPS. The partner API uses the client_credentials grant below (client provisioned out-of-band).",
        "grant_types": ["client_credentials"],
        "token_endpoint": "https://brandry.ai/oauth/token",
        "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
        "scopes_supported": ["partner:read"]
      }
    ]
  }
}
```

## How to connect (MCP)

- **Endpoint:** `https://brandry.ai/api/ucp/mcp` (JSON-RPC 2.0 over HTTP POST)
- **Server card:** `https://brandry.ai/.well-known/mcp/server-card.json`
- **Reads:** send `content-type: application/json` and POST a standard `tools/call`. No
  `Authorization` header is expected or checked for reads.

Read example (no auth):

    curl -s -X POST https://brandry.ai/api/ucp/mcp \
      -H 'content-type: application/json' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
           "params":{"name":"get_pricing","arguments":{}}}'

Token exchange (provisioned partner clients only):

    curl -s -X POST https://brandry.ai/oauth/token \
      -u "$CLIENT_ID:$CLIENT_SECRET" \
      -d 'grant_type=client_credentials&scope=partner:read'

Then call the partner API with `-H "Authorization: Bearer <access_token>"`.

## Credential use

- **Reads:** no credential of any kind.
- **Partner API:** a short-lived (1 hour) ES256-signed JWT bearer token, scoped
  `partner:read`, audience `https://brandry.ai/api/ucp/partner`. Send only over HTTPS in the
  `Authorization` header and do not persist it beyond its lifetime.

## Discovery

- **OAuth AS metadata:** `https://brandry.ai/.well-known/oauth-authorization-server`
- **OAuth PRM:** `https://brandry.ai/.well-known/oauth-protected-resource/api/ucp/partner`
- **UCP manifest:** `https://brandry.ai/.well-known/ucp`
- **A2A agent card:** `https://brandry.ai/.well-known/agent-card.json`
- **API catalog:** `https://brandry.ai/.well-known/api-catalog`
- **Agent instructions:** `https://brandry.ai/agents.md`
- **Agent skills index:** `https://brandry.ai/.well-known/agent-skills/index.json`

## Writes and transactions

**There is no automated checkout and no write tool on this site.** Brandry is sold by a human.
No card, payment, signature or personal data is ever requested from an agent here. The correct
agentic action is to surface the pricing and the modules and hand off to a person at
hello@brandry.ai.