# auth.md

Teekila publishes this file so agents can discover how to interact with
https://www.teekila.com without inventing accounts or posting form spam.

## Audience

Public marketing site for **Teekila**, an AI consulting and training agency in
Strasbourg–Schiltigheim (France). There is **no self-serve user account** and
**no OAuth token issuance** for automated agent registration.

## Public access (no credentials)

- HTML pages, `llms.txt`, OpenAPI, MCP tools, and well-known discovery documents
  are readable without authentication.
- Scope advertised for that public surface: `public.read`.
- Do **not** POST `/api/formulaire.php` on behalf of a user. That endpoint is
  reserved for humans browsing the site (same-origin / Referer check).

## Registration

Teekila does not offer ID-JAG, verified-email claim, or anonymous credential
issuance. To start a human conversation (audit, training, project):

1. Prefer a Calendly slot: https://calendly.com/olivierlegras
2. Or email **contact@teekila.com** with the agent's operator identity, purpose,
   and a human contact.
3. `POST /agent/register.php` returns `501` with the same instructions. It does
   not create accounts or issue tokens.

## Discovery documents

- Protected resource metadata: `/.well-known/oauth-protected-resource`
- Authorization server metadata: `/.well-known/oauth-authorization-server`
  (`issuer` is `https://www.teekila.com`; endpoints document unavailability)
- OpenID configuration: `/.well-known/openid-configuration`
- API catalog: `/.well-known/api-catalog`
- MCP server card: `/.well-known/mcp/server-card.json`
- Human API notes: `/docs/api.html`

## Methods supported

| Method | Status | Notes |
| --- | --- | --- |
| Anonymous / none | Documented only | No credential is issued |
| authorization_code | Not issued | Endpoints exist for discovery completeness |
| ID-JAG | Not supported | — |
| Verified email claim | Not supported | Use contact@teekila.com |

## Credential use

None. Public GET resources need no bearer token. If an agent receives HTTP 401
from a future protected API, read `WWW-Authenticate` and this file again.