# Civitta auth.md

This document describes agent registration and authentication support for Civitta.

## Agent audience

Agents can discover public site resources through `/.well-known/api-catalog`, `/openapi.json`, and `/docs/api`. These public discovery endpoints do not require agent registration.

## Registration

Self-service agent registration is not currently available. For protected integrations, contact the site operator through https://civitta.com/. Include the agent name, operator domain, software name and version, intended use, requested scopes, redirect URIs when applicable, and a security contact.

## Supported methods

Public discovery uses unauthenticated HTTPS requests. Protected agent API credentials are provisioned manually when an integration is approved.

## Credential use

Approved agents should identify their operator domain, software name, software version, and contact address when requesting protected access. Credentials are only valid for the approved integration and requested scope.

## Revocation

Credentials may be revoked by the site operator when an agent is retired, compromised, no longer needs access, or violates the approved use.