# BlueWave auth.md

Authentication guide for agents. Public BlueWave pages and `/api/v1/*` discovery
endpoints need no API key, token, OAuth flow or registration. Commercial agency
ad-account provisioning is human-mediated in Telegram.

## Agent audience

Any agent (MCP client, HTTP client, crawler) may call the public endpoints
anonymously. Identify yourself with a descriptive User-Agent.

## Endpoints

- Site: https://bluewave-agency.com/
- JSON API: https://bluewave-agency.com/api/v1/info
- Health: https://bluewave-agency.com/api/v1/health
- OpenAPI: https://bluewave-agency.com/openapi.json
- API catalog: https://bluewave-agency.com/.well-known/api-catalog
- Agent register: https://bluewave-agency.com/agent/register
- Human sales: https://t.me/bluewave_mngr

## Auth scheme

None for the public surface. Send requests directly. There is no OAuth
Authorization Server that issues bearer tokens for public discovery, so agents
must not expect a usable access_token from `/api/v1/token`.

Protected Resource Metadata: https://bluewave-agency.com/.well-known/oauth-protected-resource

## Agent registration

Registration methods supported:

- `anonymous`: the public site and discovery API. No account, registration or
  credential is created; call the endpoints directly.
- Human provisioning: contact https://t.me/bluewave_mngr for agency ad accounts.
  The Telegram flow never returns an API management token.

### anonymous

1. Optional acknowledgment: `GET` or `POST` https://bluewave-agency.com/agent/register
2. Call public endpoints with no `Authorization` header
3. Read claim/public facts from https://bluewave-agency.com/api/v1/info

There is no credential-minting `POST /agent/auth` endpoint. Machine-readable
summary (Auth.md agent_auth metadata):

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["none"],
      "claim_uri": "https://bluewave-agency.com/api/v1/info"
    },
    "register_uri": "https://bluewave-agency.com/agent/register",
    "provisioning": {
      "human_telegram": "https://t.me/bluewave_mngr"
    }
  }
}
```

Anonymous registration acknowledgment:

```bash
curl --fail-with-body https://bluewave-agency.com/agent/register
```

Public facts without credentials:

```bash
curl --fail-with-body https://bluewave-agency.com/api/v1/info
```

## Credential use

Do not put tokens in URLs. Public discovery endpoints ignore `Authorization`
headers. `bearer_methods_supported` lists `header` only for future authenticated
cabinet APIs.