# auth.md — SuperCode France Agent Authentication & Registration

This document defines how autonomous AI agents discover, register, and authenticate with **SuperCode France** (`https://supercode.fr`) per the [Auth.md specification](https://workos.com/auth-md).

## When to Use

Use this guide when integrating an AI agent, MCP client, or automated workflow with SuperCode France REST APIs (`/api/v1/cartes-memos`, `/api/v1/health`) or the Streamable HTTP MCP server (`/api/mcp`).

## Audience

Autonomous AI agents, search/answer engines, and MCP clients accessing SuperCode France educational resources and APIs.

## Zero-Auth Public Sandbox & Read Access (No API Key Required)

All core educational endpoints and the MCP server are publicly accessible without credentials (zero-auth free tier & live sandbox):

- `GET https://supercode.fr/api/v1/cartes-memos` (or `GET https://supercode.fr/api/cartes-memos`)
- `GET https://supercode.fr/api/v1/health` (or `GET https://supercode.fr/api/health`)
- `POST https://supercode.fr/api/mcp` (Streamable HTTP JSON-RPC 2.0 MCP Server)
- `GET https://supercode.fr/llms.txt` & `GET https://supercode.fr/llms-full.txt`

## Discovery Endpoints

- **OAuth Protected Resource Metadata (RFC 9728)**: `https://supercode.fr/.well-known/oauth-protected-resource`
- **OAuth Authorization Server Metadata (RFC 8414)**: `https://supercode.fr/.well-known/oauth-authorization-server`
- **OpenID Connect Configuration**: `https://supercode.fr/.well-known/openid-configuration`
- **Developer Portal & Quickstart**: `https://supercode.fr/docs`

## Agent Registration & Provisioning

Agents requiring user-scoped Bearer credentials may register via:

- **Registration Endpoint**: `POST https://supercode.fr/api/agent/auth`
- **Supported Identity Types**:
  1. `anonymous` — Issues a read-only `bearer_token` with claim URI `https://supercode.fr/login`.
  2. `identity_assertion` — Supports `verified_email` and `urn:ietf:params:oauth:token-type:id-jag` assertions.

## Credential Usage

Pass the issued Bearer token in the HTTP `Authorization` header:

```http
Authorization: Bearer <access_token>
```