# Agent Authentication & Registration Guidelines — AppWand

This document specifies authentication and dynamic agent registration procedures for AI agents interacting programmatically with AppWand services (`https://appwand.net`).

## Overview

AppWand provides OAuth 2.0 and OpenID Connect (OIDC) compliant authentication for automated agents, integrations, and developer client applications.

- **Issuer**: `https://appwand.net`
- **Authorization Endpoint**: `https://appwand.net/oauth/authorize`
- **Token Endpoint**: `https://appwand.net/oauth/token`
- **Agent Dynamic Registration URI**: `https://appwand.net/oauth/register`
- **JWKS Endpoint**: `https://appwand.net/.well-known/jwks.json`

## Identity & Credential Types Supported

### Supported Identity Types
- `autonomous_agent`: AI assistants operating independently on behalf of users or enterprise tasks.
- `user_delegated`: Client agents acting under explicit user token grant.

### Supported Credential Types
- `client_credentials` (OAuth 2.0 Client Credentials Grant)
- `authorization_code` (OAuth 2.0 Authorization Code Flow with PKCE)
- `bearer_token` (RFC 6750 Bearer Tokens)

## Dynamic Agent Registration

AI agents may register programmatically by issuing a `POST` request to `https://appwand.net/oauth/register`:

```http
POST /oauth/register HTTP/1.1
Host: appwand.net
Content-Type: application/json

{
  "client_name": "Example-AI-Agent",
  "grant_types": ["client_credentials", "authorization_code"],
  "response_types": ["code"],
  "scope": "read:services write:inquiries estimate:projects"
}
```

## Available Scopes

- `read:services`: Read company service offerings, portfolio, and technology stacks.
- `write:inquiries`: Submit project scope inquiries and contact forms.
- `estimate:projects`: Calculate estimated budget and timeline for development scopes.

## Token Revocation & Introspection

- **Token Revocation URI**: `https://appwand.net/oauth/revoke`
- **Token Introspection URI**: `https://appwand.net/oauth/introspect`