# auth.md

This document describes how automated AI agents, bots, and LLMs authenticate with Sähködiili.fi.

## Step 1 — Discover

Agents should first read `/.well-known/oauth-protected-resource` and then fetch the authorization server configuration from `/.well-known/oauth-authorization-server`.

## Step 2 — Choose a method

The `agent_auth` block in the authorization server configuration lists the supported methods. Sähködiili.fi supports the `anonymous` and `identity_assertion` identity types.

## Step 3 — Register

Automated registration is supported. If using `identity_assertion`, agents send a POST request to the `register_uri` (`/agent/identity`) to mint credentials. For `anonymous` access, no formal registration at `/agent/identity` is required, and public APIs can be accessed immediately.

## Credential Use

Obtain an `access_token` from `/token` and use it as a Bearer token.