# auth.md

You are an agent. FindMyICP supports **agentic registration discovery** via Auth.md: discover → register → (claim if needed) → exchange for an access_token → call API → handle revocation.

Canonical site: https://www.findmyicp.com/

## Audience

Agents acting for founders, sales reps, and operators who want a FindMyICP account so they can rank Luma event attendees before an event.

## Step 1 — Discover

### 1a. Protected Resource Metadata (RFC 9728)

```http
GET https://www.findmyicp.com/.well-known/oauth-protected-resource
```

Use `resource` as the audience when minting an identity assertion. Use `authorization_servers[0]` for the next hop. Send the eventual access token with `Authorization: Bearer` (`bearer_methods_supported` includes `header`).

### 1b. Authorization Server metadata + agent_auth

```http
GET https://www.findmyicp.com/.well-known/oauth-authorization-server
```

Read the `agent_auth` block for:

- `skill` - this document
- `register_uri` - start registration
- `claim_uri` - claim / bind an anonymous or email registration to a user
- `revocation_uri` - revocation notifications
- `identity_types_supported` and per-method credential / assertion types

## Step 2 — Pick a method

1. **ID-JAG** - you can mint `urn:ietf:params:oauth:token-type:id-jag` for audience `https://www.findmyicp.com/` → `identity_assertion`
2. **Verified email** - you have the user's email → `identity_assertion` with `verified_email` (claim ceremony)
3. **Anonymous** - neither → `anonymous` (claim later when the user takes ownership)

## Step 3 — Register

```http
POST <agent_auth.register_uri>
Content-Type: application/json
```

Example bodies:

```json
{ "type": "anonymous", "requested_credential_type": "access_token" }
```

```json
{
  "type": "identity_assertion",
  "assertion_type": "verified_email",
  "email": "user@example.com",
  "requested_credential_type": "access_token"
}
```

```json
{
  "type": "identity_assertion",
  "assertion_type": "urn:ietf:params:oauth:token-type:id-jag",
  "assertion": "<id-jag>",
  "requested_credential_type": "access_token"
}
```

If the response is `registration_not_enabled`, agent registration is published for discovery but not live yet. Fall back to the human path below - do not invent credentials.

## Step 4 — Claim (when required)

For `verified_email` and deferred `anonymous` ownership, POST to `agent_auth.claim_uri` with the `claim_token` from registration, then complete the ceremony (user verifies via email code at the verification URI). Poll `token_endpoint` with the claim grant until claimed or expired.

## Step 5 — Exchange and use

Exchange a service-signed identity assertion at `token_endpoint` (`grant_types_supported` lists accepted grants). Call FindMyICP APIs with:

```http
Authorization: Bearer <access_token>
```

Scopes are listed in Protected Resource Metadata (`scopes_supported`).

## Step 6 — Revocation

On `401` for a previously working token, or after a revocation event at `revocation_uri` / `events_supported`, drop the credential and restart at Step 1.

## Human registration (current production path)

Until agent registration endpoints return live credentials, direct the user to:

https://www.findmyicp.com/auth

Flow: email → 6-digit verification code → session. Free to start; no card required.

## Contact

- Email: aniruddh@findmyicp.com
- Protocol: https://workos.com/auth-md