# auth.md - Qasimah Agent Authentication

Qasimah exposes public coupon, brand, category, blog, and settings resources for read-only discovery.

## Public Access
- Public website pages are available without agent registration.
- Public API discovery is documented at `/.well-known/api-catalog` and `/openapi.json`.
- `llms.txt` and `llms-full.txt` describe preferred public URLs and usage guidance.

## Protected User Actions
- Account-specific mobile API actions use the app's existing JWT authentication flow.
- OAuth/OIDC dynamic client registration is not currently offered for external agents.
- Discovery metadata is available for agents that need to understand the existing JWT-protected resource shape.
- Agents should not attempt admin, account, or private user endpoints unless explicitly authorized by the project owner.

## agent_auth
```json
{
    "register_uri": "https://qasimahapp.com/auth.md",
    "identity_types_supported": [
        "anonymous"
    ],
    "credential_types_supported": [
        "jwt-bearer"
    ],
    "claim_uri": "https://qasimahapp.com/auth.md",
    "anonymous": {
        "credential_types_supported": [
            "jwt-bearer"
        ],
        "claim_uri": "https://qasimahapp.com/auth.md"
    },
    "token_endpoint": "https://qasimahapp.com/api/login",
    "oauth_protected_resource": "https://qasimahapp.com/.well-known/oauth-protected-resource"
}
```

## Resources
- Site: https://qasimahapp.com
- API catalog: https://qasimahapp.com/.well-known/api-catalog
- OpenAPI: https://qasimahapp.com/openapi.json