# auth.md

You are an agent. Counted supports **agentic registration** so you can
read its public information and call its public Model Context Protocol (MCP)
endpoint on a user's behalf: discover -> register -> (claim if needed) -> call
API -> handle revocation. Follow the steps in order; do not skip ahead.

Counted (Counted Labs AS) is one workspace for Nordic accounting firms:
every client in one place, with each ledger analysed automatically.
Public surfaces are read-only. Business contact for humans and for any
registration question: hello@usecounted.com

## Step 1 — Discover

Discovery is two hops.

### 1a. Fetch the Protected Resource Metadata

```http
GET https://evening-quince-30593.dagny.site/.well-known/oauth-protected-resource
```

Read `authorization_servers` from the response. The `agent_auth` block lives on
one of those servers (here: this same origin).

### 1b. Fetch the Authorization Server metadata

```http
GET https://evening-quince-30593.dagny.site/.well-known/oauth-authorization-server
```

Read the `agent_auth` block in full. It tells you where to register
(`register_uri`), how to claim (`claim_uri`), how revocation is signalled
(`revocation_uri`), and which identity and credential types this service
accepts (`identity_types_supported` and the nested `*_supported` arrays).

## Step 2 — Pick a method

Counted accepts:

- **anonymous** — register with no user identity and receive an `api_key`
  scoped to public reads. A claim ceremony is optional; defer it until the user
  wants to take ownership.
- **identity_assertion** — if you hold a user identity you can exchange for an
  ID-JAG audience-bound to this service, or a verified email, present it to
  receive an `access_token` or `api_key`. The verified-email variant requires a
  claim ceremony.

Cross-check your choice against the `agent_auth` block before sending. If the
matching `*_supported` array does not list your method, pick another or stop.

## Step 3 — Register

POST to the `register_uri` from the `agent_auth` block.

```http
POST https://evening-quince-30593.dagny.site/agent/auth
Content-Type: application/json

{
  "type": "anonymous",
  "requested_credential_type": "api_key"
}
```

For `identity_assertion`, send `type: "identity_assertion"` with either
`assertion_type: "urn:ietf:params:oauth:token-type:id-jag"` (and your ID-JAG
JWT, `aud` set to the `resource` from Step 1a) or
`assertion_type: "verified_email"` (and the user's email). Surface the service
name before asserting a user identity; that is the user's consent gate.

## Step 4 — Claim ceremony (optional for anonymous)

The goal is to have the user read back a 6-digit code so a human takes
ownership of the registration.

```http
POST https://evening-quince-30593.dagny.site/agent/auth/claim
Content-Type: application/json

{
  "claim_token": "clm_...",
  "email": "user@example.com"
}
```

The user receives an email, opens the link, and reads back a 6-digit OTP.
Submit it to complete the claim. Until automated registration is fully live,
the claim contact of record is hello@usecounted.com.

## Step 5 — Use the credential

Present the credential as a bearer token against the public MCP endpoint:

```http
POST https://evening-quince-30593.dagny.site/api/mcp
Authorization: Bearer <credential>
Content-Type: application/json

{ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }
```

Public reads do not require a credential today; the bearer token is honoured
when present. On a 401 for a previously-working credential, drop it and restart
at Step 1.

## Revocation

You do not initiate revocation yourself. A provider that minted your ID-JAG can
POST a `logout+jwt` to the `revocation_uri` from the `agent_auth` block. For
anonymous or email flows there is no agent-facing revoke endpoint: on a 401 for
a previously-working credential, drop it and restart at Step 1.

## For agents

- Protected resource metadata: https://evening-quince-30593.dagny.site/.well-known/oauth-protected-resource
- Authorization server metadata (carries agent_auth): https://evening-quince-30593.dagny.site/.well-known/oauth-authorization-server
- MCP server: https://evening-quince-30593.dagny.site/api/mcp (JSON-RPC 2.0)
- Full context: https://evening-quince-30593.dagny.site/llms-full.txt
- Human contact: hello@usecounted.com