# auth.md

Agent registration and authentication discovery for [HandsOnTech](https://www.handsontech.io/).

## Audience

Public HTTP JSON APIs on `https://www.handsontech.io` are intended for browsers, first-party UI, and well-behaved agents. There is **no public OAuth 2.0 / OIDC authorization server** and **no machine client registration endpoint**.

## Public APIs (no auth)

These endpoints do not require OAuth or API keys:

| Method | Path | Purpose |
|--------|------|---------|
| POST | `/api/contact/` | Contact / lead inquiry |
| GET/POST | `/api/chat/` | Site chatbot config and Q&A (when enabled) |
| POST | `/api/tools/run/` | Run one free audit tool |
| POST | `/api/tools/run-all/` | Run all free audit tools |
| GET | `/api/tools/run/{runId}/` | Fetch run (redacted until unlocked) |
| POST | `/api/tools/unlock/` | Start email OTP to unlock a run |
| POST | `/api/verify/request/` | Request email OTP |
| POST | `/api/verify/confirm/` | Confirm OTP (sets HttpOnly verified-session cookie) |
| POST | `/api/verify/resend/` | Resend OTP |

Full schemas: [https://www.handsontech.io/openapi.json](https://www.handsontech.io/openapi.json)  
Catalog: [https://www.handsontech.io/.well-known/api-catalog](https://www.handsontech.io/.well-known/api-catalog)

Rate limits, domain cool-downs, and honeypot / abuse checks apply. Do not spam these endpoints.

## Email verification (tool unlock)

1. `POST /api/verify/request/` (or `/api/tools/unlock/`) with a real name + email.
2. User receives a one-time code by email.
3. `POST /api/verify/confirm/` with email + code.
4. Browser receives a first-party **verified session cookie** used only to unlock tool reports and raise run limits. This is not an OAuth access token and is not intended for third-party agents to store as a long-lived credential.

## Admin CMS (humans only)

`/admin/` and `/api/admin/*` use a first-party **session cookie** after password login at `/admin/login/`. There is no public self-service admin registration, no OAuth for agents, and no documented client credentials grant.

## Human registration / business contact

Agents and humans who need a commercial relationship or staff access should contact:

- Email: sales@handsontech.io
- Phone: (866) 965-8749
- Form: [https://www.handsontech.io/contact/](https://www.handsontech.io/contact/)

## Intentionally not published

- `/.well-known/oauth-authorization-server`—no public OAuth AS
- `/.well-known/openid-configuration`—no public OIDC IdP
- `/.well-known/oauth-protected-resource`—public APIs are not OAuth-protected resources
- x402 / MPP / UCP / ACP—no agent payment or commerce protocols on this site

## Related discovery

- [llms.txt](https://www.handsontech.io/llms.txt)
- [Agent skills](https://www.handsontech.io/.well-known/agent-skills/index.json)
- [MCP server card](https://www.handsontech.io/.well-known/mcp/server-card.json) (HTTP capability description; not a live MCP WebSocket)