# EZAPI Agent Authentication

EZAPI Portal exposes public discovery metadata for agents at https://test.easyapi.work/.well-known/api-catalog.

## Current OAuth status

This portal does not currently operate an automated OAuth authorization server for third-party agents. The OAuth metadata endpoints are published for readiness and discovery, but the authorization, token, and revocation endpoints are non-operational placeholders that return explicit unsupported responses.

Human users can authenticate through:

- Login: https://test.easyapi.work/login
- Registration: https://test.easyapi.work/register
- Password reset: https://test.easyapi.work/forgot-password

## Agent registration

Agents should read https://test.easyapi.work/.well-known/agent-registration before attempting integration. Supported identity types are:

- human-supervised-agent
- organization-managed-agent
- dns-verified-agent

Supported credential types are documented as non-operational readiness metadata:

- oauth-client-assertion-jwt
- signed-agent-manifest
- api-token-issued-by-user

## Scopes

The discovery surface is read-only. Published scopes are:

- discovery:read - read public service metadata
- status:read - read public health metadata
- docs:read - read public documentation

## DNS-AID external step

DNS-AID cannot be completed by application code. To enable DNS-assisted agent identity, publish DNS TXT records for the production domain outside this app. Suggested records:

- _agent.test.easyapi.work TXT "aid=v1; issuer=https://test.easyapi.work/.well-known/oauth-authorization-server; docs=https://test.easyapi.work/auth.md"
- _mcp.test.easyapi.work TXT "mcp=https://test.easyapi.work/.well-known/mcp/server-card.json"

These records are not claimed as published by this app. Verify them with your DNS provider before advertising DNS-AID as active.