# auth.md

aptu.dev is machine-payable API infrastructure for autonomous agents. Free
discovery surfaces require no credentials. Agents may read all public
surfaces directly at https://aptu.dev without registration. Paid endpoints
use the x402 protocol, not credentials.

## Discovery

OAuth metadata endpoints are published for agent discovery:

- Authorization server metadata: https://aptu.dev/.well-known/oauth-authorization-server
- Protected resource metadata: https://aptu.dev/.well-known/oauth-protected-resource

## Registration

No registration is required to access the free surfaces of this API. There
is no sign-up flow, no account creation step, and no credential to obtain.
Follow these steps:

Step 1: No registration required. Skip any account or sign-up flow entirely.

Step 2: Send an ordinary unauthenticated HTTP request. For example:

```
curl -s https://aptu.dev/v1/catalog
```

The request carries no Authorization header and returns HTTP 200. No token,
session, or cookie is ever issued, and there is no token endpoint, no
revocation endpoint, and no introspection endpoint because no tokens are
created.

Step 3: Read any free resource directly. The machine-readable index at
https://aptu.dev/llms.txt and every discovery endpoint below are openly
readable without prior registration.

The supported identity types and credential types are listed below.

identity_types_supported: anonymous

register_uri: https://aptu.dev/.well-known/agent-auth.json

claim_uri: https://aptu.dev/.well-known/agent-auth.json

Anonymous access does not require a token, session, or credential of any
kind. All free resources are openly readable. Agents may read them without
any prior registration step.

credential_types_supported: none

No credential is issued, stored, or exchanged. Paid endpoints (POST
/v1/echo) are metered by payment via x402, not by identity.

## AI-Optimized Content

- Machine-readable index: https://aptu.dev/llms.txt
- Full content index: https://aptu.dev/llms-full.txt
- Agent notes: https://aptu.dev/agents.txt
- API catalog: https://aptu.dev/.well-known/api-catalog
- x402 manifest: https://aptu.dev/.well-known/x402